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MEETING THE CHALLENGE: ARE MISSED 
OPPORTUNITIES COSTING US MONEY? 


THURSDAY, JUNE 28, 2007 

U.S. Senate, 

Subcommittee on Federal Financial Management, 
Government Information, Federal Services, 

AND International Security, 

OF THE Committee on Homeland Security 
AND Governmental Affairs, 
Washington, DC. 

The Subcommittee met, pursuant to notice, at 3:03 p.m., in Room 
342, Dirksen Senate Office Building, Hon. Thomas R. Carper, 
Chairman of the Subcommittee, presiding. 

Present: Senators Carper, McCaskill, and Coburn. 

OPENING STATEMENT OF SENATOR CARPER 

Senator Carper. The Subcommittee will come to order. First, let 
me just welcome back my colleague. Dr. Coburn, who was out for 
a week or two, bounced back from an operation, and he is back. He 
said to me yesterday he is about 80 percent back to where he was. 
Dr. Coburn at 80 percent is better than most of us at 180 percent, 
so we are happy you are back and feeling well. 

Senator Coburn. Thank you. Glad to be with you. 

Senator Carper. I want to say a special welcome to our wit- 
nesses today. This is a conversation we have been having for a 
while and this is really the continuation of a conversation that we 
have had and need to have. I think it was last June, Senator 
Coburn and I asked GAO to determine three things. 

The first thing we asked them to do was to look at the Depart- 
ment of Homeland Security and to tell us whether or not they had 
fully developed plans for implementing or migrating to an inte- 
grated Department-wide financial management system. That was 
the first thing we asked them to do. The second thing we asked 
them to do was to tell us whether or not the work produce received 
for the funds spent on the eMerge 2 modernization effort could be 
used. And finally, the third thing we asked them was how the De- 
partment could incorporate best practices into its plan for migrat- 
ing to an integrated Department-wide financial management sys- 
tem moving forward. 

Today, we are going to hear what GAO found, and unfortunately, 
the news is not as good as we had hoped it might be. GAO is cer- 
tainly here to speak for themselves, but GAO found that the De- 
partment continues to lack a clearly defined financial management 
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strategy and a plan to move forward with financial management 
modernization efforts. 

We will also hear today from two knowledgeable take-charge De- 
partment officials about the ongoing efforts to transform, to consoli- 
date, to integrate their financial management systems, and we look 
forward to hearing what progress the Department is beginning to 
make, as well. 

As we all know, the Department has faced a number of over- 
whelming challenges since its creation in 2003, and while the De- 
partment has made some progress, a whole lot of work remains to 
be done. I sort of liken that your job at Homeland Security is a lit- 
tle bit like what we used to do in Navy Aviation. Every now and 
then, you have to change an engine on your airplane, and it is a 
job that took maybe 24 hours. It took a while. It is not easy to do. 
But the job that they are trying to do in terms of developing a fi- 
nancial management system that is good, that is effective, and to 
run the Department well, it is a little like changing an aircraft en- 
gine with the aircraft airborne, and not an easy thing to do, and 
we realize that. But aircraft engines need to be changed and we are 
looking for better progress here in the months to come. 

I think it is unfortunate that this iteration of the eMerge 2 
project has been officially pronounced, maybe denounced, as dead, 
particularly after some fco, $52 million or so was spent trying to 
make it operational. But in declaring it dead, the Department did 
something that Federal agencies rarely do, and what you did is you 
stopped a flawed and failing program before even more money was 
wasted, and for that, I think the Department should be com- 
mended. 

I look forward to hearing from GAO and the Department as to 
what, if anything, can be salvaged from the work products devel- 
oped for eMerge 2 and for all the money that was spent in paying 
for these efforts. Most importantly, I am interested in learning how 
the situation can be avoided in the future. 

Given the enormity and the complexity of the problems facing 
the Department over 4 years following its creation, I am personally 
not surprised that eMerge 2 failed. Bringing together 22 different 
organizations with different missions and different cultures is not 
an easy thing to do. It is sort of like trying to merge, if you will, 
22 large corporations, not just two large corporations into one, but 
22 large corporations with different missions, different personnel 
systems, different cultures and putting them in together and make 
it work. That is not easy and this hasn’t been easy and we realize 
that. 

But we have to make sure that the Department has learned from 
its failures so we don’t repeat the same mistake as the Department 
moves forward. We all share, I believe, the same objective, and that 
is how can the Department of Homeland Security successfully 
transform and modernize its financial management systems so that 
you can do your jobs better, and when we have a Hurricane 
Katrina or we have threats to our homeland, that you are there to 
protect us and do the job. 

I have a couple of questions I am going to be asking later on, but 
I will just telegraph them now. Here are several of my questions. 
Where do we go from here? What tools does the Department need 
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to accomplish that objective or those objectives? What assurances 
do we have that the Department will not fail as you undertake the 
transformation and systems consolidation program? In other words, 
have the lessons learned from the eMerge 2 failure been incor- 
porated into your plan for moving forward, and how can Congress 
play a constructive role in that path forward? 

The Department of Homeland Security has needed a Chief Fi- 
nancial Officer who puts taxpayers first and who is committed to 
sound financial management and transparency, and Mr. Norquist, 
by all accounts, you are making a diligent and, I am told, impres- 
sive effort to do just that. As I am sure you know, your partnership 
with Mr. Charbo is central to the success of that effort. Addition- 
ally, your ability to incorporate GAO’s recommendations with 
which the Department concurs is also critically important. 

Sound financial management is critical to the success of the De- 
partment and to all of our departments. It is the foundation of any 
organization, any program, or any activity. 

Last year, there were reports by the GAO and Inspector General 
of the Department revealing delays, revealing cost overruns, re- 
vealing design inadequacies and operating deficiencies in the Deep- 
water contract, the largest contract ever awarded, I believe, by the 
Coast Guard. A separate GAO report released this past January es- 
timated that the total wasted funds related to Hurricane Katrina 
relief may top $2 billion, largely as a result of the continuing prev- 
alence of no-bid reconstruction contracts. The $52 million that went 
into eMerge 2 is yet another example of that. 

As elected Members of Congress, our greatest stakeholders are 
the American people and we have an obligation to ensure the dol- 
lars are being used as effectively and efficiently as possible. The 
war in Iraq has cost us roughly a half-trillion dollars. The deficit 
this year is forecast at roughly $180 billion, and although that is 
better than last year, it is nothing to brag about. Such sectors as 
housing are experiencing challenging times. Consumer spending is 
down. This is a time not to be frivolous with our hard-earned 
money. 

In closing, let me just add. Congressional oversight, I believe, 
and Senator Coburn knows, and Senator McCaskill, who is a Mem- 
ber of this Subcommittee and will probably join us, we were in Ku- 
wait and Iraq about 10 days ago doing oversight there on a lot of 
the contracting work that had been done, no-bid contracts, cost- 
plus contracts, sole-source contracts, not the kind of thing that 
would make most of us proud. But I think we are doing a better 
job of oversight there and I think they are starting to clean up 
their act over there, at least in that regard. 

But Congressional oversight is imperative to make sure that Fed- 
eral agencies like this Department are stepping up to the plate, 
confronting the waste of precious taxpayer dollars, and taking im- 
mediate corrective actions so our dollars are supporting the real 
mission of the Department, and that is protecting our country and 
nearly 300 million Americans who live here. 

We look forward to hearing from each of you and we look forward 
to continuing to work closely with GAO and with the Department 
in achieving a successful implementation of modern financial man- 
agement systems. 
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With that, Dr. Coburn. 

OPENING STATEMENT OF SENATOR COBURN 

Senator Coburn. Thank you, Mr. Chairman. I have a statement 
that I would like to have submitted for the record. 

Senator Carper. Without objection. 

Senator Coburn. I want to welcome you. I want to say again how 
much I appreciate GAO and the work that they do. I continue to 
be impressed by all aspects of GAO and their dedication to helping 
us solve the problems that we find in front of us. 

I also want to thank you, Mr. Norquist. We spent some time in 
my office and I am not sure I can make any judgment about what 
you have done yet. I think it is way too early, and so I am not crit- 
ical at this juncture. 

I think the most important thing, and we saw on the vote — this 
whole week has been a great week for America because what you 
saw is America tuned in to what is happening in Washington, and 
I don’t think there is anybody sitting at that table that can be 
proud of the financial mess that we have, and not just at Homeland 
Security, but in many other areas. And with that comes about $200 
billion a year in waste, fraud, abuse, and duplication. I think there 
is a rumble in America. I think they are awake. I think they are 
listening, and what they are wanting is transparency and account- 
ability. 

The real problem is you can’t manage what you can’t measure, 
and you all can’t measure it. Now, that is not necessarily your fault 
sitting at this table because you haven’t been in the position of re- 
sponsibility. But I think we are very blessed to have GAO help us 
and to be a positive critique in the areas where you may not have 
the insight or you may not be looking at all the areas when you 
thank you are. 

So we look forward to your testimony. I do have to excuse myself 
early and I apologize for that. Again, I am not going quite at the 
speed that I would like to go, and so I can’t accomplish everything 
that I want to accomplish in a day, but I am encouraged by the 
attitudinal change. I am encouraged by the prospects of change. 
Don’t let the American people down. Change it. Fix it. Make it to 
where it is auditable. Make sure that the $40 billion that comes 
your way, you can account for, they can see it in a transparent 
way, and they can make a judgment about whether or not you are 
good stewards with their hard-earned money. Thank you. 

[The prepared statement of Senator Coburn follows:] 

PREPARED STATEMENT OF SENATOR COBURN 

I am under no illusion that the theme of this hearing is glamorous or will catch 
many headlines. Frankly, the arcane and technical nature of financial management 
will probably never grab the attention of the American people as well. But what the 
American people do care about is results. When the job can’t get done and security 
is compromised, people are not likely to have sympathy simply because financial 
management systems were not working properly — they will only ask why we didn’t 
get it right. When Katrina victims were trying to get assistance to rebuild homes, 
or find temporary housing, nobody wanted to hear about problems with DHS finan- 
cial systems. 

The Department of Homeland Security gets tens of billions of dollars every year. 
We will soon be debating an almost $40 billion approps bill for the Department. 
Without proper financial controls, we have no way of ensuring that this money is 
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buying us the security Americans expect. DHS does not have an operational man- 
agement plan currently in place to effectively manage it finances. 

For example, this past month the DHS Inspector General published an audit re- 
port on grant management for American Samoa. In it, the Inspector General exam- 
ined homeland security grant awards from fiscal years 2002 to 2004, totaling more 
than $12 million. Of that total, the IG found over $1.7 million in questionable 
spending. Money was spent sending staff on questionable trips to Las Vegas and 
Hawaii, fancy furniture, and an illegal interagency transfer with the National 
Weather Service. 

I do not need to remind people of the travesty that befell New Orleans and the 
Nation in August 2005. Hurricane Katrina displaced hundreds of thousands of resi- 
dents from their homes, leaving vulnerable families and individuals to depend on 
the government for assistance in the wake of the unspeakable tragedy. Regrettably 
and inexcusably, DHS and FEMA subsequently made over $800 million in improper 
payments in assistance efforts following Katrina. Let’s put that figure in more tan- 
gible terms: For $800 million, FEMA could have provided over 13,000 trailers for 
families to live in for 18 months. The Gulf Coast and the Nation deserve better. 

These examples are no surprise, given how dysfunctional financial management 
is at DHS. The Departments independent auditor, KPMG, noted that The Depart- 
ment of Homeland Security is out of compliance with eight separate laws and regu- 
lations — and these include our most basic financial management statutes. DHS also 
has never received an Unqualified Audit Opinion (UAO) — This means that the fi- 
nancial information they have is not timely, reliable, or DHS has never gotten an 
auditor to say that DHS’s financial statements, on the whole, are presented fairly 
in all material respects in conformity with Generally Accepted Accounting Prin- 
ciples. In other words, they can’t undergo an audit, much less pass one. If Congress 
applied the same standards to DHS that we have forced on the private sector. Sec- 
retary Chertoff and most of his senior management would be in jail. 

That’s not to say that DHS is staffed by bad actors, or incompetent managers. 
Congress created this behemoth bureaucracy as a knee-jerk reaction to 9/11. The 
Department faced the nearly insurmountable task of integrating and streamlining 
22 disparate agencies upon the Department’s inception in 2003. The first attempt 
at comprehensive integration ended miserably, with the failure and abandonment 
in 2005 of the Electronically Managing Enterprise Resources for Government Effec- 
tiveness and Efficiency project, otherwise known as Emerge 2. Clearly, The Depart- 
ment of Homeland Security is now at an important crossroads regarding financial 
management. DHS must implement a plan that will successfully carry the Depart- 
ment to a reliable, consistent, and functional financial management operating sys- 
tem. 

First we need political will at the highest levels of leadership. This will force the 
interagency coordination and the prioritization required to get results. Next, we 
need transparency. I’m expecting to get clear commitments for deliverables in this 
project today, and a public reporting on a regular basis of progress against those 
commitments. Specifically, I would like a commitment for a timeframe on producing 
an auditable financial statement and also a detailed strategy to clean up the finan- 
cial management disaster at the Coast Guard. 

I would like to commend the efforts at DHS, and David Norquist in particular 
who has an unenviable task, to say the least. I also want to thank GAO, who is 
truly fulfilling its mission as our investigator and auditing arm, investing the time 
and resources into a level of detailed oversight that we are not able to invest di- 
rectly. I look forward to hearing your testimonies, thank you. 

Senator Carper. Thank you, Dr. Coburn. 

I am not going to provide in the introductions the background. 
Biographies of all of our witnesses — although I would ask that, I 
call them the PG versions of your biographies, that I could disclose 
those, but they were not provided, so we are just going to provide 
for the record what we received. 

Some of you have been before us a couple times before. We are 
delighted that you are here again. McCoy Williams from GAO, we 
are delighted that you are here again and we would ask you to go 
ahead and present your testimony. If you have full testimony you 
would like to present for the record, we will certainly, for every one 
of our witnesses, that will be presented and included in the record, 
and if you want to summarize, fine. I would say, just try to keep 
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your testimonies fairly close to 5 minutes, but if you go 6 or 7 min- 
utes, we are not going to shut you down. Welcome. 

TESTIMONY OF McCOY WILLIAMS, i DIRECTOR, FINANCIAL 
MANAGEMENT AND ASSURANCE, ACCOMPANIED BY KE ITH 
RHODES, CHIEF TECHNOLOGIST, APPLIED RESEARCH AND 
METHODS, CENTER FOR ENGINEERING AND TECHNOLOGY, 
U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. Williams. Thank you, Mr. Chairman. Mr. Rhodes and I 
thank you for the opportunity to discuss our recent work related 
to DHS’s efforts to transform its financial management systems. 

As you know, the Department of Homeland Ssecurity has faced 
a difficult challenge of bringing together 22 diverse agencies. Since 
2003, when DHS began operations, GAO has designated imple- 
menting and transforming DHS as a high risk. Our related report 
released today discusses the significant problems we identified with 
DHS’s financial management system modernization efforts. Today, 
we would like to provide our perspectives on the importance of 
DHS following best practices in developing and implementing its fi- 
nancial management systems. 

First, since we last testified in March 2006, DHS officials ended 
its eMerge 2 program. eMerge 2 was expected to establish the stra- 
tegic direction for modernization and integration of DHS financial 
management systems, processes, and policies. DHS officials have 
stated that approximately $52 million in total was spent on this 
project before it was halted, although DHS did not provide us docu- 
mentation to support these reported costs. DHS’s decision to end 
the project before spending an estimated $229 million on a finan- 
cial management system that would not provide the expected sys- 
tem functionality and desired performance was prudent and we 
support the decision to cut its losses. 

According to DHS officials, several of the work products devel- 
oped for eMerge 2 will be useful as they move forward with their 
financial management modernization efforts. However, we found 
that the usefulness of these work products is questionable due to 
the lack of disciplined processes in their development. 

Second, we would like to point out key financial management 
system transformation challenges at DHS. While DHS officials 
have recognized the need for an integrated financial management 
system, the Department has not developed a transformation effort 
that includes key elements, such as standard business processes, a 
human capital strategy, and effective internal controls. 

In March 2007, DHS issued its Internal Controls Over Financial 
Reporting Playbook, a high-level plan intended to address existing 
internal control weaknesses. DHS officials have acknowledged that 
the Playbook has a policy and process focus and does not comprise 
a strategy for financial management system modernization. DHS’s 
high-level financial management system strategy, called Trans- 
formation and Systems Consolidation, focuses on leveraging exist- 
ing systems investments across DHS components and is still in the 
early stages of development. More detailed implementation strate- 


^The prepared joint statement of Mr. Williams with Mr. Rhodes appears in the Appendix on 
page 27. 
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gies will be necessary to fully address financial management sys- 
tem integration efforts. 

The Transformation and Systems Consolidation strategy calls for 
DHS to consolidate its financial management systems into one of 
two models, the Transportation Security Administration systems 
model, or the U.S. Customs and Border Protection Systems model, 
which the Department refers to as shared baselines. DHS and 
0MB officials told us that 0MB approved DHS’s decision to rely on 
its in-house core financial management operations. Our concern is 
that these components have numerous financial management 
weaknesses and consequently do not appear to be good models for 
an entity with an annual budget in excess of $40 billion. 

For example, the financial statement auditors for TSA reported 
that TSA was unable to support key fiscal year 2005 and 2006 
transactions and account balances. It is imperative that DHS fully 
understands the weaknesses at TSA in order to prevent these 
issues from affecting subsequent users. 

Finally, we would like to highlight the building blocks that form 
the foundation for successful financial management transformation. 
Our previous testimony and our current report pointed out that 
careful consideration of these four concepts, each one building upon 
the next, will be key to the success of DHS’s strategy. The four con- 
cepts are developing a concept of operations, defining standard 
business processes, developing a migration and/or implementation 
strategy for DHS components, and defining and effectively imple- 
menting disciplined processes necessary to properly manage the 
specific projects. 

Fully embracing human capital best practices will be another 
critical success factor. For example, DHS will need to have people 
with the right skills in the right place and at the right time. 

In conclusion, Mr. Chairman, given that DHS is one of the larg- 
est and most complex Executive Branch agencies in the Federal 
Government, modernizing its financial management systems rep- 
resent a monumental challenge. This challenge is compounded by 
the poor condition of the legacy financial and related business sys- 
tems it inherited. If properly implemented, the recommendations 
included in our related report, which are based on best practices, 
will help reduce the risk associated with a project of this mag- 
nitude and important to an acceptable level. Ultimately, DHS will 
be able to provide reliable, useful, and timely financial manage- 
ment information so that DHS leadership and the Congress are 
well positioned to make fully-informed decisions to secure Amer- 
ica’s homeland. 

We look forward to continuing to work with you to monitor 
DHS’s progress in this area. Mr. Chairman, this concludes our 
statement. We will be pleased to respond to any questions that you 
may have. 

Senator Carper. Mr. Williams, thank you very much. Are you 
still the Director of Financial Management and Assurance at GAO? 

Mr. Williams. That is correct. 

Senator Carper. And how long have you been in that post? 

Mr. Williams. I have been a Director in that team for approxi- 
mately 7 years, 2 of those years in an acting position. 
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Senator Carper. This may not be a fair question, but at GAO, 
who is your Chief Technologist for Applied Research and Methods 
at your Center for Engineering and Technology? Who does that 
work? 

Mr. Williams. That would be Keith Rhodes. 

Senator Carper. The fellow sitting right next to you. 

Mr. Williams. That is correct. 

Senator Carper. I understand he is taking a pass on testifying, 
but he is here to respond to any questions that Senator McCaskill 
and I might have? 

Mr. Williams. That is correct. 

Senator Carper. All right. Good. We will save the really tough 
ones for him. 

Mr. Williams. OK. [Laughter.] 

Senator Carper. I was fortunate to travel with Senator 
McCaskill back about a week and a half ago. I talked about that 
a little bit earlier and the work that you and your staff have done. 
Wendy Anderson and I were just privileged to go with you to see 
the efforts that are underway there to try to fix our contracting 
problems and we appreciate your work to help this Department get 
its act together. We know that they are trying to, and we know 
that your efforts are helpful there. 

Mr. Rhodes, we welcome you here today and we look forward to 
asking you some questions a little later, too. 

The Chief Financial Officer at the Department of Homeland Se- 
curity is David Norquist and he is joined today by Scott Charbo, 
who is the Chief Information Officer (CIO). We are happy you are 
both here. You have been in your job for about a year, is that right, 
Mr. Norquist? 

Mr. Norquist. That is correct, sir. 

Senator Carper. And Mr. Charbo, how long have you been at it, 
a couple of years? 

Mr. Charbo. It will be 2 years in July. 

Senator Carper. Alright. Does it seem longer? 

Mr. Charbo. There is normal time and there is DHS time, yes, 
sir. [Laughter.] 

Senator Carper. Well, we are glad you are here today, and Mr. 
Norquist, you are recognized. Again, your entire statement will be 
made a part of the record. Proceed as you wish. 

TESTIMONY OF DAVID NORQUIST, i CHIEF FINANCIAL OFFI- 
CER, ACCOMPANIED BY SCOTT CHARBO, CHIEF INFORMA- 
TION OFFICER, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. Norquist. Thank you. Senator. Mr. Charbo and I have a 
joint statement. Thank you. Chairman Carper, Members of the 
Subcommittee, for allowing us this opportunity to testify before you 
regarding financial management system modernization at the De- 
partment of Homeland Security. Scott Charbo and I are pleased to 
discuss with you the Department’s strategy and progress in trans- 
forming and consolidating financial management systems through- 
out the Department. We also appreciate the work done by the Gov- 


^The prepared joint statement of Mr. Norquist and Mr. Charbo appears in the Appendix on 
page 40. 
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eminent Accountability Office and concur with all six of their rec- 
ommendations. 

The Department of Homeland Security was formed from the 
merger of 22 distinct agencies. Given our origin, it is not surprising 
that we would have multiple financial systems. In the long run, 
however, this is not cost effective. Too many systems complicate fi- 
nancial reporting, internal controls, systems security, and software 
maintenance. 

In 2003, to address this problem, the Department began an ini- 
tiative called eMerge and contracted out for the development of a 
financial solution that integrated finance, accounting, procurement, 
and asset management systems. That integration effort ran into 
technical challenges and, as GAO describes it, the Department 
made a prudent decision to cut its losses. 

This, however, is not the end of the story. With Department ap- 
proval, Customs and Border Protection successfully implemented 
the SAP Financial Package that includes finance, accounting, pro- 
curement, and asset management. This strengthens GBP’s finan- 
cial reporting and internal control processes, and last year, CBP re- 
ceived an unqualified opinion on its financial statement. 

About the same time, the Transportation Security Administra- 
tion needed to migrate off the system it used at the Department 
of Transportation. In response, the U.S. Coast Guard provided TSA 
an Oracle package that also included procurement and asset man- 
agement. Other offices expressed an interest in this solution, and 
over the last 2 years, the Department has migrated the Federal Air 
Marshals Service and the Domestic Nuclear Detection Office to the 
same solution. While TSA is still addressing some material weak- 
nesses, it is now the system that stands between them and a clean 
audit opinion. 

When you review the different systems the Department has, 
these two agencies’ solutions stand out. They use core accounting 
applications that are also used by other large Federal agencies with 
unqualified audit opinions. They were successfully and broadly im- 
plemented inside DHS, so we have people who are experienced 
with these applications. The products are also commercially avail- 
able and supported by multiple vendors, which promotes competi- 
tion. 

So rather than pursue the acquisition, configuration, and imple- 
mentation of a new system within DHS, we will leverage our exist- 
ing investments by continuing the migration of components to 
these two proven financial management systems. We have briefed 
the system, called Transformation and System Consolidation, to 
the Office of Management and Budget and we meet with 0MB rou- 
tinely to discuss progress. 

The next stage of the consolidation plan will begin with the mi- 
gration of small components, such as the Office of Health Affairs 
and Science and Technology. The goal is to repeat, refine, and build 
upon each successful migration. The plan will continue with the 
migration of larger components, such as FEMA and Immigration 
and Customs Enforcement. By fiscal year 2009, we expect 50 per- 
cent of DHS components to be on the Consolidated Einancial Man- 
agement System. By fiscal year 2011, we expect 97 percent of the 
Department will be on these systems. 
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After the completion of this consolidation plan, a single baseline 
will be chosen. Migration onto a single baseline will then be 
planned and implemented. The Department is committed to a sin- 
gle baseline as the end state for its financial management needs. 

There are a number of financial and performance benefits associ- 
ated with this initiative. This includes a reduction in maintenance 
cost, a significant cost avoidance for future integration expenses, 
and it promotes competition for systems operation and mainte- 
nance services by making sure that you can have multiple vendors 
to support your system. It also provides more accurate, timely, and 
reliable financial data, provides a foundation for effective internal 
controls and segregation of duty, and reduces the errors by the re- 
moval of manual processes. 

Modernizing financial management systems is an inherently 
complex and challenging endeavor. It requires careful planning, pa- 
tient implementation, and strong collaboration among senior lead- 
ers. The strategy I have described today provides for improving fi- 
nancial systems by migrating components to existing DHS systems 
that are proven and for which we have a record of successful imple- 
mentation. I am confident that, working together, we will be suc- 
cessful. 

Sir, I thank you for your leadership and your continued support 
of the Department of Homeland Security, and if I may add, I also 
appreciate the close working relationship I have been able to de- 
velop with your staff. I have been up here before to give them up- 
dates. They are a very good group to work with and I appreciate 
the ongoing dialogue that we have. 

Senator Carper. We appreciate your saying that and thank you 
for being so accessible and your willingness to come here. That is 
much appreciated. 

We have been joined by Senator Claire McCaskill of Missouri. 
Senator McCaskill, if you have a comment or two you would like 
to offer, and why don’t you lead off with the questions. 

OPENING STATEMENT OF SENATOR MCCASKILL 

Senator McCaskill. Thank you, Mr. Chairman. I am a little dis- 
combobulated about leading off. 

Senator Carper. You don’t have to. 

Senator McCaskill. That is not the way it works around here. 

I am very concerned about financial management systems at 
Homeland Security. Frankly, you are in a little better shape than 
the Department of Defense. I think they have been on the high-risk 
since, if my memory serves me correctly, since 1991, would that be 
right, Mr. Rhodes? 

Mr. Rhodes. [Nodding head.] 

Senator McCaskill. And since you have not been around long 
enough, we hope that you beat them off the list and that would be 
a great thing. 

I am going to spend my time talking about accountability issues, 
and I know it is slightly off topic in terms of financial management 
systems, but let us start with this. The $52 million that you have 
indicated was spent on eMerge, is it possible for you to document 
in any way how that $52 million was spent? 
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Mr. Norquist. We have provided from my office a spreadsheet 
to GAO on the range of things. Of that amount, $18 million, for ex- 
ample, went specifically to the contractor. The $52 million is a 
broader range of initiatives that occurred during this time period. 
It is my understanding that the documentation that couldn’t be 
achieved was out of our procurement office, and I am happy to go 
back and find out why that wasn’t available and to follow up on 
that for you. 

Senator McCaskill. Yes. I am really worried about that procure- 
ment office. I couldn’t help notice that the Washington Post did not 
do your Department a favor by the article that appeared this morn- 
ing in light of this hearing coming. The procurement office is prob- 
lematic. What percentage of the money that you have spent in try- 
ing to get off the high-risk list would you say has been spent on 
private contractors? 

Mr. Norquist. I wouldn’t know the number for that. 

Senator McCaskill. Would you hazard a guess? More than 50 
percent? 

Mr. Norquist. I can only use my own office as an example. I 
have in my office about $12 million that we spend on salaries of 
government officials and $8 million that we do on other contract 
support, which is heavily contracted individuals, internal controls, 
improper payments, that sort of area. So it is not a 50-50 split. It 
is less than that. 

In fact, in my office, when we submitted our budget request, I 
notified the Appropriations Committee of my intent to increase the 
number of government employees that we have. As we were cre- 
ated at DHS, there was an initial shortage of career civil servants 
that wwould be used to build with, so people relied on contractors. 
Over time, we have tried to move away from that. I am doing that 
within my own organization to increase our reliance on career civil 
servants. I myself started as a GS-9 back in 1989, and so I have 
got a lot of initiatives focused on training them, getting the skill 
sets. I believe that in the long run, they are more important to our 
stable success. 

Clearly, there are places where we need contractors for inde- 
pendent verification, validation, other functions, but I think that in 
the near-term, at least in my organization, there is a need to shift 
and I have indicated so in our budget submissions. 

Senator McCaskill. Do you have a sense that the leadership at 
the Department of Homeland Security has your bias as it relates 
to the apparent inefficiencies of contracting that we are witnessing 
at the Department of Homeland Security? 

Mr. Norquist. There are trade-offs between the two, and in 
meetings, I have been with the Deputy Secretary as we build the 
budget. He has gone and raised the issue with components of what 
do you have in your organization that is only contractor because 
that is the way you started and tell me when you can do that and 
what your hiring skills are. So I know he shares that interest. I 
know he recognizes that as an opportunity for improvement. 

We can’t leave the function undone, but in my office, for example, 
we had staffing shortages a year ago. We weren’t able to fill our 
own positions. We went and created a number of efforts to improve 
recruiting and retention. Working with our Chief Human Capital 
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Officer, there have been job fairs and advertisements. We have 
tried to make life easier for people to find us. I have a little busi- 
ness card that simply says, CFOjobs@dhs.gov. Send me an e-mail. 
So when we reach people and we go to areas where there are skill 
sets that I am looking for, financial management communities, we 
have promoted that in order to get the folks inside and get them 
in the government service. 

We have been successful. We have filled the positions that Con- 
gress has provided us, and we have, and again, as I mentioned be- 
fore, told them that we are looking to go beyond that and in ex- 
change drive down the amount of money that I spend on contractor 
support for these types of functions. 

Senator McCaskill. Well, as the CFO, do you feel like that you 
have information Department-wide in terms of the way money is 
being spent within the Department? 

Mr. Norquist. You can do it by various categories. It is hard to 
break it out the way people normally ask the question. For exam- 
ple, if you buy something, you are usually buying a service or a de- 
liverable, not a number of people, and so you cannot easily get a 
contractor number. That is why in my office I use the dollar 
amount. I don’t know if I tried to ask that question department- 
wide how the numbers would come up or how we would present it. 

Senator McCaskill. Well, did you read the article in the Wash- 
ington Post this morning? 

Mr. Norquist. Yes, I did. 

Senator McCaskill. OK. And do you think taxpayers should be 
worried? 

Mr. Norquist. My understanding of the article was the need to 
stand up the staffing and the requirement to use contractor sup- 
port in the first place. I can’t speak to the contracting procedures 
that were used to do that, but I know that there is an essential 
mission that they are trying to perform. And this is one of the chal- 
lenges I run into in financial management, is I put a great empha- 
sis on internal controls, on strengthening procedures, and I need to 
be cognizant of the component’s requirement to perform its mis- 
sion, and so we work very closely with others to ensure that we ac- 
complish both at the same time. 

Senator McCaskill. Are you aware of any contracts currently 
within the Department of Homeland Security that are not com- 
peted? 

Mr. Norquist. I actually wouldn’t know. I am generally only 
aware of the ones in my office and I believe those are all competed, 
but I will check that for the record. 

Senator McCaskill. Well, for the record, Mr. Chairman, I would 
basically summarize as follows. We have a project in Homeland Se- 
curity that began in 2003 with a $2 million contract. It was no-bid. 
It soared by millions of dollars per month, and in December 2004, 
the payments had exceeded $30 million and 15 times the contract’s 
original values. When the Department lawyers looked at it, they 
said it was grossly beyond the scope of the original contract and 
that it violated government procurement rules. The lawyers then 
advised the Department to immediately stop making payments 
through the contract. 
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That did not happen. Payments continued under the contract. In 
fact, the payments to the consultant more than doubled again 
under the second no-bid arrangement, this time to $73 million. And 
it goes on to set out in some detail that this was a situation where 
the rules were waived, routinely waived, to, in fact, continue to 
support this contract. 

I think that this is one of those situations that if we do not get 
to the bottom of what has actually happened at the Department of 
Homeland Security, we have no lessons learned, and I think Con- 
gress, when they created the Department of Homeland Security, 
had an old-fashioned notion that they were consolidating and mak- 
ing something more efficient. I don’t think that people anticipated 
that the skill sets were not going to be present within this newly- 
created Department to do basic functions that were being given to 
it, and I don’t think anybody — I can’t imagine they envisioned that 
we would embark upon a protracted period of time with vague con- 
tract requirements, with no-bid contracts blowing the lid off the 
original scope of the contracts, and I know that this is not your De- 
partment. However, when you have the title CFO and you are part 
of an organization that has this kind of systemic problems, whether 
it is bringing together financial systems or whether it is appro- 
priate oversight of procurement, I think it is fair to make this part 
of the record. 

I am going to ask the Secretary specific questions about the Boos 
Allen consultant contract that was delineated in the newspaper 
this morning and I am particularly interested how many other con- 
tracts like this are out there. I mean, the cost of these contract em- 
ployees is an average of $250,000. That is an expensive government 
employee. I don’t have anybody in my office making $250,000 a 
year, and I am willing to bet there is nobody in your office making 
$250,000 a year. 

I am trying to figure out why we have gotten into this privatiza- 
tion, this wave of privatization where we are blowing the top off 
average costs of work being done. I have never been opposed to pri- 
vatization as a principle, but the way it is being done right now, 
whether we are in Iraq and we are talking about what is hap- 
pening in Iraq or we are talking about within the Department of 
Homeland Security, something is terribly wrong and I think it is 
really incumbent upon Congress and this Subcommittee to get a 
handle on it, and I appreciate, Mr. Chairman, the opportunity to 
put that in the record and certainly appreciate the opportunity to 
participate in this hearing today. I thank you all for being here. 

Senator Carper. You are quite welcome, and we are just de- 
lighted that you are here. 

Does anybody want to respond to some of what Senator 
McCaskill has stated or asked? 

Mr. Norquist. Just one follow-up, because among the things 
that do fall under the CFO is the budget. In the President’s budget 
submitted to the Hill, there are a number of initiatives that we 
have supported, particularly to strengthen 

Senator Carper. Is this the budget for 2008? 

Mr. Norquist. This is the budget for 2008, the one that is on the 
Hill — to strengthen the Office of the Chief Procurement Officer pre- 
cisely to ensure that she has the training programs, the hiring pro- 
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grams, and the initiatives to strengthen her oversight of the pro- 
gram in the same way the Congress has been supportive in 
strengthening the Chief Financial Officer’s program. So I hope you 
would give consideration to those and recognize how directly re- 
lated they are to helping her organization get a similar handle on 
the challenges that they face. 

Senator McCaskill. You will never have to worry about me sup- 
porting more money for GAO, more money for IGs, or more money 
for procurement officials. I am there. 

Mr. Norquist. Thank you, ma’am. 

Senator Carper. I think you can take that to the bank. [Laugh- 
ter.] 

I want to back up just a little bit, if we could, back to the time 
that this Department was created some 4 years ago, and it was cre- 
ated, some of the early work was done by the Committee on which 
Senator McCaskill and I serve, and we acknowledged at the time 
that what we were putting together was a little bit of a dog’s 
breakfast in terms of all these different 22 agencies coming to- 
gether with a wide variety of responsibilities. I know there was 
some discussion about how well their financial systems would 
blend together and it has been every bit as challenging to get the 
Department formed up, staffed, getting people to sort of under- 
stand who is doing what and developing relationships and trying 
to be effective. 

At the time when we created the agency, we never talked about, 
at least in my recollection, about eMerge 2, and what I want really 
for my first question is I would like for somebody to back up and 
just give us the history, if you will, for this initiative and explain 
it in terms that regular lay people can understand. Sometimes we 
get talking about this stuff and you hear it and you say, what did 
they really say? So just kind of put it in layman’s terms. Could 
somebody give us the history, what we were trying to accomplish 
within the Department when eMerge 2 was launched? 

When I heard about it, my question to my staff was, whatever 
happened to eMerge 1, and it turns out there was no eMerge 1. 
They went right to eMerge 2. I was going to say, three strikes and 
you are out. If you don’t get eMerge 3 right, you are really in trou- 
ble. But there was no eMerge 1, so whatever comes next, and I 
think you have mentioned what comes next, will be the second time 
out. But it is important to get that one right. 

But would somebody give us a little bit of history on eMerge 2, 
please, someone who feels comfortable with it? Everybody looks the 
other way. [Laughter.] 

Mr. Norquist. Well, I was just expecting that they had probably 
been on this topic 

Senator Carper. Yes, you are probably right 

Mr. Norquist [continuing]. Since I wasn’t here. 

Senator Carper. You all can just give me a team effort in giving 
us the history, if you will. 

Mr. Norquist. Well, let me start with just a general overview, 
recognizing that I wasn’t here at the time, so I don’t want to put 
words in their mouth, but they came together and they realized 
that they had a large number of different financial systems and 
that creates a lot of challenges. 
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The first challenge it has is every time you want to build some- 
thing to go with it, a travel system, something else, you have to 
build a link between your new application and every different sys- 
tem that you have, and in some cases, it is not just different sys- 
tems, there are multiple variations on the same system. We have 
a number of different types of Oracle that are being run inside the 
Department. So you end up spending a lot of money building more 
bridges than you need to make a link to each of these. So there is 
an opportunity for cost avoidance if you can get down to fewer sys- 
tems. 

In addition, the shared data across the system is a challenge if 
you are operating differently. 

Another essential one is if you want your — if you don’t have an 
integrated system, when your procurement office enters a PO into 
their system, they then take a hard copy and walk it down the 
hallway and give it to their finance office, who logs it into their ac- 
counting system. You have two opportunities here for a problem. 
One is the time delay. Timely and accurate data runs into trouble 
every time you are depending on somebody walking a stack of doc- 
uments down the hall, and accuracy suffers every time you require 
somebody to re-enter it. So to have a system of when it is entered 
on the contracting side it automatically appears correctly on the ac- 
counting statement gives you much better timely and accuracy in 
your data. 

And so those types of accomplishments, those are the things you 
are looking for. In addition, if you have the right system, it is a 
big benefit for internal controls. So, for example, if you have a pol- 
icy that says in order to commitment the government to so much 
money, you have to have a warrant of greater than that amount, 
now, you can have manual processes to enforce that, but if your fi- 
nancial system looks at the warrant of the person entering the data 
and says, I am sorry, you don’t have a high enough warrant to do 
this, I am rejecting the transaction, the system is reinforcing that 
control. 

Or if it is looking at a place where you have multiple — you want 
to have segregation of duties. You don’t want the same person or- 
dering the item as the one who has accepted it as the one who is 
paying for it. You break those up, you greatly complicate fraud. If 
the system doesn’t let that data get entered by those three as the 
same individual, it is reinforcing your internal processes. 

So when somebody looks at that, having a modern, integrated fi- 
nancial system is a huge step forward. Now, the challenge is how 
you get there, and there are a number of different ways to do it. 
The one they chose probably had the biggest potential payoff, but 
I would also suggest had the biggest risk. You have somebody, you 
make a list of the thousands of requirements, which they did. I 
think GAO counted and said 8,000 and climbing. 

Senator Carper. Now say that again. When they are trying to 
create the system, or envision it, they had 8,000 requirements that 
were laid out? 

Mr. Norquist. Well, if I ask you, what do you need your account- 
ing system to do, the list is endless if you approach it that way, 
and then you turn to someone and say, please deliver me a system 
that does this, and then they have to do software development, and 
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software development is also very challenging. All of those steps 
add risk. 

The reverse of that is, for example, what our approach would be. 
We have an accounting system and an integrated system at CBP 
and over at TSA. You go to somebody who is moving and saying, 
why can’t that meet your needs? Give us an example of what it 
does that you need to. So rather than do thousands of require- 
ments, you are doing what is called gap analysis. All of those make 
it easier. 

But their approach to the solution, I think, had a high oppor- 
tunity for payoff, but it is a very challenging task and I think the 
way they went about it probably increased the risk. But having not 
been there at the time, I think I will of defer to GAO now in terms 
of having looked at the records, anything they found about the 
challenges in that approach and what went wrong. 

Senator Carper. Good. That is very helpful for background. 

Can you just take it up from there and fill in the gaps? 

Mr. Williams. Yes, I can, and I think just to summarize it real 
short, I was asked by the full Committee to take a look at what 
the agency was doing to consolidate its operations from a financial 
management standpoint when the agency was formed, and we basi- 
cally concluded that eMerge at the time, that it was really too soon 
to tell whether it would succeed or not, that it appeared to be a 
good idea, that if you wanted to consolidate all your systems, be- 
cause you had these 22 agencies. 

The bottom line was Homeland Security was basically looking at 
a situation in which there were all these agencies coming together, 
components coming together, and everybody was basically carrying 
out their operations based on what they had been accustomed to 
doing from wherever they came from, and the concept was, we will 
have one system that will be able to gather data and produce data 
that will be consistent across the entire Department. 

A case in point was at the time, I was asked to do a job at FEMA 
and there were some issues that had been raised about some cap- 
italization thresholds and just how they were accounting for their 
property. And we had some suggestions and were basically told 
that we cannot make these changes for FEMA because the Depart- 
ment is looking at everything that is going on in the financial man- 
agement arena, from systems to policies to procedures, and we are 
going to try to standardize everything so that everything can be 
done across the agency the same way so we will have the consist- 
ency. 

So that was the objective when this whole process started, we 
wanted one system that can gather data for all of these agencies 
or components that we are bringing together and we will have this 
one system. We will have the consistency. We will also be able to 
reduce our costs because we will cut down on a lot of the redun- 
dancy that is going on. So that was the basic overall agenda when 
this process first started. 

Senator Carper. Where do you think it started to come apart? 

Mr. Williams. I will let you take that one. 

Mr. Rhodes. In the requirements, the requirements failure re- 
garding eMerge. So you have 22 pieces of broken pottery, and I 
don’t know what the pot looks like. Now I am supposed to glue 
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them all together and make something of it. I am not an account- 
ant. I am an engineer. But my accounting colleagues have sat me 
down and showed me a 32-column piece of paper and said the num- 
ber in the lower left-hand corner is supposed to add up to some- 
thing. Fine. Now what do I feed into that eMerge 2 system? 

Well, none of the systems that the Department of Homeland Se- 
curity inherited — and that is the key term, they inherited them — 
none of them had actually been designed. They had all evolved. 
Like all the departments they came from, they had evolved. They 
were unique. They were one of a kind. They were, oh, we do things 
differently here designs. They were, gee, we can’t actually get a 
clean opinion system, but now DHS has to take that system and 
bring it in. 

So it begins with a requirement set. One of the reasons it was 
8,000 and climbing is that if you don’t apply the discipline to say, 
you are done, you are done, you are done, I don’t want to hear from 
you anymore, we are going to do it this way, if either you don’t do 
that or you can’t do it, then you are in the position of having zero 
discipline in your process. You are just trying to draw all of the re- 
quirements together into the dog’s breakfast, as you are talking 
about, and say, oh, well, whatever comes up will come up, which, 
of course, is a vendor’s dream and the oversight’s nightmare. 

Senator Carper. Mr. Charbo, do you want to add anything? 

Mr. Charbo. No, I think that was well said. At the end of the 
day, if we were successful in that new system, you still had the 
challenge of the internal control processes and migrating things 
that didn’t add up into a new system. Those were a lot of the points 
that we were pointing out to the Department as I came in in July 
and trying to point out some of the flaws, as well, which led to 
some of the cancellation of the contracts and deciding to move on 
with another strategy. I think all those points were well said. 

Senator Carper. Mright. Fair enough. Senator McCaskill. 

Senator McCaskill. So 8,000 requirements is ludicrous on its 
face. Was there no one there to say that is too many? Are you say- 
ing there were 8,000 requirements because they were trying to ac- 
commodate 22 different evolved systems and everything that they 
had traditionally gotten out of their product, they wanted all of 
that to come out of this new product? 

Mr. Rhodes. In effect, the lack of discipline that they were ap- 
plying was doing that by default. You are correct. I don’t know that 
anyone was getting up in the morning and saying, gee, let us just 
have it be all things to all people. But what we saw in the initial 
reviews was that no one knew how to put the brake on, and there- 
fore the requirements list goes up and the money goes out and the 
oversight on the part of DHS was not in place. 

Contracting out, fine. That is not supposed to be abdication of re- 
sponsibility. It is contracting out. It is not abdication. It is not, be- 
cause then the contractor — have been a contractor. I came out of 
the contracting world. All it takes is money and I will make you 
happy. Well, fine. So you keep giving me enough rope in terms of 
dollars and I will keep weaving a basket out of it. That is what was 
happening. There wasn’t anything in place to stop throwing coal 
into it to keep the engine burning. 
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Senator McCaskill. And I have to assume, in the private sector, 
you have mergers and acquisitions as commonly as you have any- 
thing else. I have to assume there are products even off the shelf 
that could he adjusted to accommodate different functions coming 
together for the first time. 

Mr. Rhodes. You are correct. There are products out there, but 
often, commercial off-the-shelf does not mean one-size-fits-all. Like- 
wise, just because you have bought commercial software does not 
mean that you now give up being ultimately the system engineer. 

Senator McCaskill. Right. 

Mr. Rhodes. You have to understand your requirements. You 
have to come in with a discipline. You have to lay them out. You 
have to say, what is my concept of operations? What is my target? 
What am I trying to do? Well, if I am trying to be all things to all 
people, there is nothing on the shelf that is going to 

Senator McCaskill. Right. It is not going to be there and it is 
going to cost 

Mr. Rhodes. Forever. 

Senator McCaskill [continuing]. $52 million and then you are 
going to cancel the contract. 

Mr. Rhodes. It is going to cost forever. 

Senator McCaskill. Do you believe that the problem of dis- 
cipline when it comes to financial management has, in fact, been 
addressed at the Department of Homeland Security? 

Mr. Rhodes. I cannot say that I have hard evidence that it has. 
The movement to kill eMerge is a sign. The movement — as the 
CFO stated, they concur with everything we have said. 

Senator McCaskill. Sometimes that feels like kissing your sis- 
ter. We don’t get it fixed. 

Mr. Rhodes. Right. Exactly. 

Senator Carper. To which my sister would say, even sisters need 
to be kissed. [Laughter.] 

Senator McCaskill. Well, do you sense that they now have that 
discipline, though? I know you are saying you have no hard evi- 
dence that the discipline is now in place to not abdicate? 

Mr. Rhodes. Right. 

Senator McCaskill. Alright. 

Mr. Rhodes. I do not have the hard evidence. I will have to see 
what goes on from now. I have good words. I have good intentions. 
I do not believe I am being lied to. Fine. Now let us see, because 
our joint testimony this year is no different than our joint testi- 
mony last year. 

Senator McCaskill. Right. And do you all have a sense that 
there is any hope of discipline at the Department of Homeland Se- 
curity as it comes to the abdication that was documented in the 
Washington Post concerning contract oversight? 

Mr. Rhodes. Do you want to take that? 

Mr. Williams. It is a process, a discipline that must be put in 
place in the financial management arena, and I would say in look- 
ing at the overall process, you are talking about internal controls 
within the entire Department. And I have done a lot of work over 
the years in the area of internal controls and working with what 
we call our Green Book, which basically lays out the framework of 
what you need to have in place, and I think that it is important 
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that the agency as a whole take a look at those five pillars, as I 
call them. 

I think the key one is that we talk about the tone at the top, and 
that is that you have to start at the top of any organization and 
make sure that the right tone is set as far as we will have the good 
controls in place. We will have accountability in place. And that 
has to filter down throughout the organization. 

Once you start with that and you take those other four concepts 
that are laid out in that document, then you have the framework 
in place to make sure that you have good controls. 

Mr. Rhodes. Let me make one additional point about that tone 
at the top. The tone at the top has to last longer than the life ex- 
pectancy of the appointee. It has to be institutional. It can’t be, 
fine, all well and good, Mr. Norquist, and he has the good inten- 
tions and then he leaves after his half-life of 18 months or 

Senator McCaskill. Maybe gets hired by one of those contrac- 
tors. 

Mr. Rhodes. Perhaps. 

Senator McCaskill. Because he could make $250,000 a year. 
Why would he hang out with us poor saps on the public payroll? 
[Laughter.] 

Mr. Rhodes. Yes, ma’am. The point is that whoever comes in has 
to be able to keep that target in mind, and that is why we talk 
about concept of operations, discipline in the process, and Mr. Wil- 
liams’ discussion about internal controls. If those are there and 
they are taken seriously, then it doesn’t really matter who is in the 
seat. They are still acting according to this road map. 

Senator McCaskill. Well, and this reminds me that there are so 
many similarities between the Department of Defense and the De- 
partment of Homeland Security because the context of the mission 
overshadows the need for fiscal accountability. In other words, the 
piece this morning in the Washington Post, it was about the intel- 
ligence operation. So it was like what we are trying to do is so im- 
portant, we don’t need to worry about cost value. We don’t need to 
worry about whether or not we are following Contracting 101. We 
don’t need to worry about whether or not we are actually over- 
seeing the contract in a cost-effective way, because this is way 
more important than how much it costs, which is what you hear 
from sometimes commanders in the Department of Defense and the 
military. What we are doing is so important, who cares if the con- 
tract is not specific and is cost-plus and it costs billions of dollars 
more than it should? I shouldn’t say, who cares. That is not fair. 

But the point is, do you believe that we need to do something in 
the process of confirming the secretaries of these departments as 
it relates to commitment to financial accountability? 

Mr. Williams. Just a quick history on this. I have heard that 
statement before. I also have responsibility for the financial man- 
agement issues at the Department of Defense and I can recall 
when we were trying to get 

Senator McCaskill. You poor thing. [Laughter.] 

Mr. Williams [continuing]. Financial data related to Desert 
Shield. This was back in 1991, I believe, and I think the response 
that I got was that I do not have time to stop and keep these 
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records. I am fighting a war. So I have heard that story for many 
years going bacL 

But my response then and my response now is that if you put 
good policies, good procedures in place and you have that structure 
there, when you go to war, there will he policies and procedures, 
that information will he rolled up. It is not something that you 
want to have to just stop while you are in the middle of a war to 
put in place. You want to have that in place well in advance. You 
want to have the internal controls. You want to have the policies 
and procedures. You want to have the systems. 

And as I always like to point out, you need to have all of those 
things because that old saying about you are only as strong as your 
weakest link, you can have the good systems, poor internal con- 
trols, you are still going to have problems. You can have the best 
system in the world, but if you lack the quality staff to either run 
and to manage your operations, you are still going to have some 
problems. 

So you have all those components that you need to have in place 
and you need to put that structure in place. Whether you require 
that from management or leadership of the organization, anything 
that we can do to make sure that there is good accountability with- 
in an organization when it comes to financial systems, financial re- 
porting, it has got to be a good idea. You have to look at it from 
a cost-benefit standpoint, of course. But improving it through hold- 
ing people accountable, GAO has always supported that. 

Senator McCaskill. Thank you, and I hope, Mr. Chairman, that 
the testimony next year is different. I can only hope. 

Senator Carper. Well, I hope so, too. I know we will be here ask- 
ing for your testimony, and I think that is an important thing for 
us in exercising our oversight responsibilities, is to make sure that 
GAO, in the exercise of your responsibilities, that we are there 
backing you up and we appreciate your support and working with 
the IGs and the CFOs. 

A member of my staff handed me a note. It said, maybe the 
CFOs shouldn’t be Presidentially appointed, and I am sure we have 
some Presidentially appointed that are quite good, but I worry 
about the turnover, and someone said 18-month half-lives in some 
of these positions. 

Mr. Norquist, any thoughts along those lines? 

Mr. Norquist. Yes, a couple. First is, originally, the CFO at 
DHS was not. It was the DHS Financial Accountability Act that re- 
quired Senate confirmation and hence I am here. 

The thing I would say to also reassure the Subcommittee about 
continuity is in the entire financial management community at 
DHS, I am the only political appointee. I am there because of the 
Senate confirmation rules, but everyone below me, the CFO and 
the Deputy CFO of FEMA, CBP, ICE, and so forth, my own deputy, 
all career civil servants. I am happy either here or later to talk 
about the initiatives we have to mentor and develop the next gen- 
eration of CFOs. That is one of the initiatives that I have been 
pushing, because we have no natural career pipeline. We are only 
4 years old. And I want to make sure that we keep that path of 
career civil servants strong. 
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The other side is I have great support from my leadership. I have 
strong backing from the Secretary and the Deputy and the Under 
Secretary for Management. I meet with them regularly, not just 
about this, but also the entire audit, the financial statements, how 
we are doing on the corrective action plans. But GAO, and you are 
right in that at a certain point in time, all of us will be asked to 
move on. Others will come in, and making sure that the leadership 
down the pipeline shares the same commitment that our current 
Secretary has is very important. I convey it to my staff. 

The thing that is interesting about what they call sort of the tone 
at the top and what your staff says is, does anyone care about me, 
is it shows up. They know when the Deputy Secretary shows up 
to the new hire training program for the Financial Management 
staff and tells them about how important it is, what they are doing. 
They know when the Secretary is asked at the hearing, every ap- 
propriation budget hearing, about the status of the audit. They un- 
derstand when the leadership provides us an additional SES posi- 
tion to strengthen our Finance and Accounting Office. All of those 
things that are the tone at the top are conveyed to the career civil 
servants and they understand and appreciate that commitment. 

But they are right. If I didn’t have that, I am not even sure I 
would undertake an endeavor because I wouldn’t be confident in its 
success. 

Senator Carper. Thank you for that statement. 

I want to move on to a couple different questions, if I could. Mr. 
Charbo or Mr. Norquist, your Department has already embarked 
on a new project you have alluded to. I just want to thank you for 
not using the acronym, but I think it is called the Transformation 
and Systems Consolidation. And I think you have embarked on a 
new project without fully implementing GAO’s recommendations 
that were released in their report today. Did you agree with that 
assessment, and if you do or don’t, within the Department, how 
will you avoid repeating the problems and failures, if you will, that 
we realized in eMerge 2 ? 

Mr. Norquist. There are some of them we have done. There are 
some of them that still remain to be done, and I certainly appre- 
ciate their feedback on any one that we can make stronger. We 
have the software development life cycle documentation. We have 
done our analysis of alternatives. Certain ones, like the concept of 
operation, which as GAO points out is so essential, we developed 
one for DNDO and we moved them in the fall of last year and we 
will update each component that we move. The CONOPS will be 
specific to that move. Likewise, the reengineering which they 
talked about which is so important is part of our A-123 process, 
and we go through each item over a 3-year period. 

So I think the answer at the beginning is, I believe we had made 
significant progress in each of these areas, but it is important that 
we see them through because I think their recommendations are 
sound. I have relied on them in other areas and I think that those 
things are very important. 

In terms of how do you avoid repeating the mistakes, I think it 
gets back to understanding what they did and trying to do it dif- 
ferently. For example, we are not asking people to develop thou- 
sands of requirements and then hoping a vendor can fire into a 
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wave meeting them. We have two components that use applications 
that are widely used by the government and they are the private 
sector, and we are saying to folks, we are ready to move you to one. 
Tell me why it can’t meet all your needs. And I suspect that if it 
can’t, the problem may be with the organization I am trying to 
move, not with the system. If you don’t like the process, I think you 
may need to fix the process before we change the system. 

There will be some exceptions. ICE has to handle bonds. Our sys- 
tem that CBP and others have don’t necessarily do that. We are 
happy to build that specific item that the system was not designed 
to accommodate. But this will be by exception, and my general in- 
clination will be if it works for other large Federal agencies and 
major corporations, what makes you special? I think this is the 
place where the discipline comes in. But it is not trying to gather 
the 8,000, it is trying to operate with something you have and you 
use today. 

Senator Carper. Good. Alright. Thank you. 

Mr. Rhodes, I believe the GAO has reported that many long- 
standing problems that plague financial management system im- 
provement efforts, do you think the Department was just not get- 
ting the message before? 

Mr. Rhodes. In our experience, public pain is what gets the mes- 
sage across. 

Senator Carper. Is this sufficient, do you think? Are we inflict- 
ing enough today, or did we last year? 

Mr. Rhodes. I think that they have gotten part of the message, 
and they did kill eMerge. They didn’t continue eMerge. We have 
certainly other examples where far more than the money claimed 
there that was lost was lost, upwards of hundreds of millions of 
dollars. So when it becomes so unavoidable that it is public and 
people are being chastised publicly through oversight, they tend to 
get the message. 

I go back to my earlier point. Everything that has been said rel- 
ative to our report, the complete concurrence, what Mr. Norquist 
just said, that is the right thing to say. But it is a function of, now 
let us see the integration plan and the critical path for tying all 
these systems together. 

Yes, you are moving to a shared baseline. You are also running 
multiple instances of one part of that baseline right now and it has 
unique applications running on it. How will you migrate away from 
that and not lose functionality? I mean, yes, I am putting on my 
propeller hat and being the engineer here at the moment, but that 
is ultimately where it starts to break down, and coming to someone 
and saying, tell me why you are not unique, and you say, well, I 
am unique because of this and this and this. A lot of times, it is 
not somebody necessarily coming up and saying, well, I am unique 
because my requirements are special. It is coming up and saying, 
I am unique because I am running software that I can’t get any- 
where else, or I have software and I am not really certain what it 
does, but it serves this function and we have used it forever. Now 
you are in a decomposition and a reengineering and an under- 
standing of the requirement as established in the piece of software 
that is already there. Those are the complicating factors. 
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Senator Carper. OK. How should this Department especially in- 
corporate some of the lessons learned to avoid unwise spending, 
unneeded, unnecessary spending on projects that are doomed to 
fail? 

Mr. Williams. Well, I think, as we stated earlier, that the bot- 
tom line is that if they follow those recommendations that we have 
in the report and if they follow the discipline processes as they go 
forward, if they utilize the results from their A-123 assessments, 
because I think in those assessments, if properly done, in the inter- 
nal control area, there should be some efficiencies that should come 
out of that from the standpoint of looking at the internal controls, 
they will probably find that in some places, that they have too 
many in place. In other places, they might find that they have gaps 
to fill. So I think if they utilize all of the tools and all of the things 
that we have talked about here, in going forward, you have got the 
framework for making some progress. 

The thing that I guess I reflect back on in this overall process 
is something that I also mentioned earlier, and that was a report 
that I did about 4 years ago, and I believe it was done for Senator 
Lieberman, in which I basically concluded that at this particular 
point in time, eMerge is a project that is just too soon to tell, but 
if things are done as laid out, then you have laid the groundwork 
for success. Four years later, I am basically saying the same thing, 
that we have a process here that is laid out. If successfully carried 
out, then we have an opportunity for success. It sounds like, in my 
mind, that I am repeating myself 4 years later. 

The other component of that is that I reflect back again to the 
early 1990s when I was detailed to Congress and involved in draft- 
ing of the Chief Financial Officer Act. The big debate then was why 
do you put these laws in place, and the bottom line conclusion on 
that was you put these laws in place so that you will have them 
there because Administrations will come and Administrations will 
go, so you want to have a framework in place for what you are try- 
ing to accomplish, it doesn’t matter who is there. 

So I think it is another area that is good for debate, is what type 
of structure do you need to have in place to make sure that regard- 
less of who is in place, that there are continuous efforts to achieve 
progress in these areas and you have that continuity and that con- 
sistency. 

Along that line, as GAO has testified in the past, we have kicked 
around the concept and supported the concept of maybe a Chief 
Management Officer for agencies in which you have situations in 
which you have these major management challenges. So it is some- 
thing I think we need to continue to debate and have more discus- 
sions about. 

Senator Carper. Alright. Thank you. 

Let me yield to Senator McCaskill. We have a vote underway, 
the first of four votes, and I would ask Senator McCaskill to ask 
questions for a bit if she will and then I will ask one more and we 
will call it a day. 

Senator McCaskill. I only have one more question. There was 
previous testimony earlier in the year where I had read that Home- 
land Security was putting lawyers in the room with GAO auditors 
when GAO auditors were coming in to do audit work and that they 
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were — the Department lawyers were sitting in on interviews be- 
tween the auditors and the employees there. I had questioned Sec- 
retary Chertoff about that, was not thrilled with the answer I got 
because it appeared to me he didn’t understand that there is re- 
view up-chain of an audit. You don’t put a lawyer in the room with 
the government official that you are getting information from dur- 
ing the process of the audit. 

Is there any indication that practice is still being done at the De- 
partment of Homeland Security? Are they still putting lawyers in 
the room during interviews with GAO auditors, to your knowledge? 

Mr. Williams. To my knowledge, I can speak about this par- 
ticular job. There were no attorneys present with the work that my 
staff was performing on this particular assignment. I will admit 
that we did have some delays at one point in time, and to the cred- 
it of this Subcommittee, we placed a couple of phone calls and we 
were able to get some assistance and information that we needed 
was provided in a timely manner. But to my knowledge, I do not 
recall any attorneys during our assignment. 

Senator McCaskill. Mr. Norquist. 

Senator Carper. Mr. Norquist, is it true that those two rows of 
people behind you are lawyers? 

Mr. Norquist. No, sir. Actually, they are the good career civil 
servants, and I asked them if there were any lawyers — I asked the 
same question he just answered, which was I have had many meet- 
ings with GAO without lawyers present. Did you have lawyers dur- 
ing our meetings? And they said the same thing, which was they 
didn’t. I actually once a month meet with a representative from 
GAO and have opted to go through the status of things that GAO 
has asked for and whether or not they are getting it in a timely 
manner in order to ensure that we respond to items for GAO. That 
is just one of the additional things I do. Frankly, I am used to hav- 
ing my auditors in the room. I am used to having the IG in the 
room. So I get kind of familiar with having those folks around. 

Senator McCaskill. Thank you. Thank you, Mr. Chairman. 

Senator Carper. Thanks so much for being here and for your 
comments and your excellent questions. 

Mr. Rhodes and Mr. Williams, I believe the Department of 
Homeland Security is required by law to prepare expenditure plans 
for some of its information technology projects. I believe these ex- 
penditure plans must then be approved by the Office of Manage- 
ment and Budget, and I think reviewed by GAO before Department 
management can obligate any project funds. 

First, is that a correct assumption, and second, if it is, what level 
of oversight is needed and by whom? 

Mr. Williams. The first answer is yes. That is our under- 
standing, also, is that is the process. 

I would say in general that I would consider this process to be 
an internal control, because you are basically putting a process in 
place in which, first of all, you are putting some visibility over 
what is being spent and you are putting some discipline in that 
process in which the information is basically out there for review. 

Now, the concern, what could be a problem with that is that 
when you put those numbers out there and nothing is done about 
them or there are no controls, that is where you basically have 
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form over substance in which you are going through an exercise. 
The key is not so much the exercise but what is done as a result 
of the exercise, and I think that is where the focus needs to be, is 
to make sure that there is some action behind putting those num- 
bers out there. 

Senator Carper. Alright. Do you want to add anything or take 
anything away, Mr. Rhodes? 

Mr. Rhodes. I wouldn’t dare take anything away 

[Laughter.] 

But the point I would emphasize is that an expenditure plan has 
to have what went on before and what goes on after, so there is 
an audit — there has to be a continual audit function around it so 
that the expenditure plan is not just some document sitting in iso- 
lation. They can be extremely valuable. They can be very helpful. 
And they can also be a paper exercise, as Mr. Williams said. It is 
a function of the oversight that goes on around it. 

Senator Carper. Mr. Charbo, you have not had a chance to say 
a whole lot here today. Do you want to give the benediction for us 
or add anything before we leave? 

Mr. Charbo. I would just add on the last question that Secretary 
Chertoff did pass or create a management directive around IT in- 
vestments in the Department which does provide oversight on the 
budget side on the capital planning for IT investments. That is co- 
ordinated very closely between the CFO and myself, as well as IT 
investment acquisition reviews, which also was a requirement in 
the appropriations act. So if it is over $2.5 million, it requires the 
CIO to review that expenditure, and we do look to assure that it 
is meeting certain expenditure requests. I don’t believe all expendi- 
tures go through to GAO. We do submit our CPIC, our investment 
guidelines, after the budget is released. Those are submitted over 
to GAO. Appropriations do require certain expenditures to be sub- 
mitted for approval to the Congress and then back over to GAO. 
We appreciate the opportunity. 

Senator Carper. Fair enough. Let me just say in closing, again, 
our thanks to each of you for being here today. Thank you for your 
testimony and for responding to our questions. Thank you for your 
stewardship to our taxpayers and for helping us in our exercise of 
our constitutional responsibility to conduct oversight in instances 
like this. 

I would like to think that all of our Federal agencies and our de- 
partments perform major and important responsibilities for our 
taxpayers, for the citizens of this country. A few departments really 
exist that are more important in providing our security. I know 
when we created the Department of Homeland Security, we knew 
it would be a bumpy start and we knew it would not be easy. We 
look back at the creation of the Department of Defense all those 
years ago and we recall how difficult it was for them to get their 
act together. In fact, some would argue they are still trying to get 
their act together in certain respects. 

But we need for Homeland Security to get this right, and you 
had an opportunity to try to get it right the first time, which 
eMerge 2 didn’t. You wisely pulled the plug. And now you have an 
opportunity to get it right this second time. 



26 


I would just urge you to do all that you can to restore, particu- 
larly in this regard, a measure of our faith and confidence in the 
ability of this Department to stand up and begin to handle, in this 
case it is financial affairs, in a way that we can all be proud of and 
you can be proud of 

I think with that having been said, we are going to stay on this 
and we will be here to be helpful, not just to be critical. We will 
be here to be helpful, as well, and to partnering with GAO and 
your IGs and the other folks that work with and for both of you, 
Mr. Norquist and you, Mr. Charbo. 

With that having been said, this hearing is adjourned. Thank 
you. 

[Whereupon, at 4:22 p.m., the Subcommittee was adjourned.] 
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Mr. Chairman and Members of the Subcommittee: 

It is a pleasure to be here today to participate in this hearing on the 
Department of Homeland Security’s (DHS) ongoing efforts to effectively 
modernize its financial management systems. Modem financial 
management systems are a critical component to instituting strong 
financial man^ement as called for by the Chief Finmtcial Officers (CFO) 
Act of 1990,* toe Federal Financial Management Improvement Act of 1996,^ 
and other legislation. Hearings such as this one today can be very useful to 
foster meaningful financial management reform. 

Over the years, we have reported on various agencies’ financial 
management system implementation failure. As we testified® in March 
2006, agencies continue to stmggle with developing and implementing 
integrated financial management systems that achieve expected 
functionality within cost and timeliness goals. Our recent report,^ which 
was prepared at the request of this subcommittee, discusses in detail some 
of the most significant problems and observations we identified with 
DHS’s financial management system modernization efforts. Since 2003, 
GAO has designated implementing and transforming DHS as high risk® 
because the agency has yet to implement a corrective action plan that 
includes a comprehensive transformation strategy, and because its 
management systems— especially related to financial, information, 
acquisition, and human capital management — are not yet integrated and 
wholly operational. Today, we would like to provide our perspectives on 
the importance of DHS following best practices in developing and 
implementing its financial management systems. Specifically, we would 
like to 
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• summarize DBS’s financial management systems transformation 
efforts, 

• point out key ^ancial management system transformation challenges 
at DBS, and 

• highlight the building blocks that form the foundation for successful 
financial management system transformation efforts. 

Our statement is based upon our recently issued report,® as well as our 
previous reports and testimonies, which were performed in accordance 
with U.S. generally accepted government auditing standards. 


Background 


Since DBS began operations in March 2003, as mandated by the Homeland 
Security Act of 2002,’ it has faced the daunting task of bringing together 22 
diverse agencies and developing an integrated financial management 
system. DBS inherited many financial management weaknesses and 
vulnerabilities from the 22 agencies. Auditors had identified 30 reportable 
conditions,® 18 of which were considered material internal control 
weaknesses® in the components prior to the transfer to DBS. In fiscal year 
2003, the DBS financial statement auditors reported 14 reportable 
conditions, of which 7 were considered to be material weaknesses. While 
incremental progress has been made, the material internal control 
weaknesses and financial reporting problems continued in fiscal year 
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beginning on or after December 15, 2006, to replace the term “reportable condition" with 
“significant deficiency." 

®A material weakness was previously defined as a reportable condition in which the design 
or operation of one or more of the internal control components does not reduce to a 
relatively low level the risk that misstatements caused by error or fraud In amounts that 
would be material in relation to the financial statements being audited may occur and not 
be detected within a timely period by enrployees in the normal course of performing their 
assigned functions. The new definition of a material weakness is a significant deficiency, or 
combination of significant deficiencies, that results in more than a remote likelihood that a 
material misstatement of the financitd statements will not be prevented or detected. 
According to AICPA guidance, this change is effective for audits of financial statements 
beginning on or after December 15, 2006. 
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eMerge^ Project Was 
Unsuccessful 


2006. In ffecal year 20C^, while the total number of reportable conditions 
decreased to 12, the number of material weaknesses increased to 10. Some 
of the more recent material weaknesses identified by the auditors include 
problems with fiind balance with treasury, budgetary accounting, and 
intergovernmental balances. 

In early March 2007, DHS officiate issued the Internal Controls Over 
Financial Reporting (ICOFR) Playbook, a high-level plan with a stated 
purpose of addressing the existing internal control weaknesses. DHS 
officiate have reported that the ICOFR Playbook draws from internal 
control best practices to establish a management control program that 
measures performance and provides accountability for improvement. DHS 
officials expect the ICOFR Playbook to guide DHS for the next several 
years through fundamental financial management improvement across the 
spectrum of financial activities supporting the agency’s mission. 


DHS began implementation of the Electronic^ly Mana^g Enterprise 
Resources for Government Effectiveness and Efficiency (eMei^e^) 
program in January 2004 to integrate financial management systems 
across the entire department and to address the department’s financial 
management weaknesses. eMerge* was expected to establish the strategic 
direction for migration, modernization, and integration of DHS financial, 
accounting, procurement, personnel, asset management, and travel 
systems, processes, and policies. In February 2005, the DHS CFO 
conducted a review of the eMerge* effort. DHS chose not to exercise the 
next contract option, and DHS’s contract with Bearing Point, Inc. (Bearing 
Point), the systems integrator, to acquire and implement eMerge* expired 
in December 2005. 

In March 2006, DHS’s Deputy CFO testified^ that eMerge® was taking a 
new direction in that the department was going to perform an assessment 
of existing financial management systems at the component level to 
determine whether internal resources could be lever^ed. DHS officials 
also reported that they were going to review the Office of Management and 
Budget’s (0MB) Financial Management line of Business initiative to 
assess whether migration to a shared service provider was a feasible 


’^Department of Homeland Security, March 29, 2006, testimony before the House 
Government Reform Subcommittee cm Government Management, Finance, and 
Accountability and the House Homeland Security Subcommittee on Management, 
Integration, and Oversight. 
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option. In March 2006, we testified” that DHS was at an important 
crossroads in implementing a financial management system, and we 
discussed fite necessary building blocks that form the foundation for 
successful financial management system implementation efforts. 

Finally, in September 2006, the newly appointed CFO stated that eMerge^ 
was officially “dead.” See figure 1 for a summary of the eMerge^ timeline. 
DHS officials have stated that j^proximately $52 million was ^ent on the 
eMerge* project before it was halted in December 2005. DHS could not 
provide any documentation to support these reported costs. DHS’s 
decision to end die project before spending an estimated $229 million on a 
financial management system that would not provide the expected system 
functionality and desired performance was prudent, and we support the 
decision to cut its losses. However, the agency has made little progress 
since that time and has missed an invaluable opportunity to address 
existing financial management problems. 
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Figure 1: Timeline of Key eMerge^ Events 




May27,2004 

DHS's Management Council unanimously approves the eMerge^ requirements as the 
baas for the d^rartmenfs integrated firtancia! solution. 


{ November 2004 


November 29, 2004 

Bearing Point be^s the conference : 

ts unable to ccvr^^e it. 


pilot {CRP) initiative under Task Order #1. but 


December 2004 


December 20. 2004 

OHS communicates concern regarding Beating Point's continuing perfortmnce 
proUems via a fetter requesting a performance improvement plan (PIP). 

January 2005 


January 3, 2005 . 

Bearing Pokn submits its written PIP. 

February 2005 


February 18. 2005 

Bearing Point provides eMergeS Concept of Operations Document. 


December 2005 


December 18. 2005 
Bearing Point contract expires. 

March 2006 


March 29. 2006 

eMerges takes a new direction. 


S^tember is. 2006 

eMerge^ is declared 'dead" by DHS CFO. 


Srswce-.GAO. 
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Financial 

Management Systems 
Transformation 
Efforts Are 
Incomplete 


While DHS officials have recognized the need for an integrated financial 
management system, the department has not developed an overall 
financial mans^em^t transformation strategy that includes financial 
management policies and procedures, standard business processes, a 
human capital strategy, and effective internal controls. DHS officials have 
acknowledged that the ICOFR Playbook has a policy and process focus 
and does not comprise a strategy for financial systems modernization. 
DHS’s high-level financial management systems strategy, Transformation 
and Systems Consolidation (TASC), focuses on leveraging existing 
systen^ investments across DHS components, and is still in the em’ly 
stages of development. More detailed implementation strategies will be 
necessary to fiiUy addre^ financial management system integration 
efforts. 


DHS recently provided us with its high-level strategy — TASC — which calls 
for DHS to consolidate its financial management systems into one of two 
models: the Transportation Security Administration (TSA) systems model 
or the U.S. Customs and Border Protection (CBP) systems model, which 
the department refers to as shared baselines. Some of the main objectives 
of this strategy are to realize cost savings and operational efficiencies, 
reduce the number of financial systems, and ensure that intemal controls 
are embedded in these financial systems. DHS and 0MB officials told us 
that 0MB approved DHS’s decision to rely on its in-house core financial 
management operations. 


Our concern is that the components where the proposed shared baselines 
are currently in use have numerous financial management weaknesses and 
consequently do not appear to be good candidates to be the models for an 
entity with an annual budget in excess of $40 billion. For example, the 
financial statement auditors for TSA reported^* that TSA — which is 
serviced by the Coast Guard — was unable to provide sufficient evidential 
matter or make knowledgeable representations to support fiscal year 2005 
and 2006 transactions and account balances, particularly for budgetary 
accounting and undelivered orders and property, plant, and equipment, 
among others. While DHS officials have stated that TSA’s audit 
shortcomings were centered on policies and procedures and are not 
systems-oriented problems, our analysis of the auditor’s report indicated 
tliat the problems were broad based. As DHS has recognized, success in 


‘^Department of Homeland Security, Performance and Accountability Report Fiscal Year 
S006 (Washington, D.C.: November 2006). 


GAO-07-1041T 



35 


financial management rests upon a comprehensive framework of people, 
policies, processes, systems, mid assurance. Accordingly, it is imperative 
that DHS fully understmids the policy and procedures weaknesses at TSA 
in order to prevent such weaknesses from affecting subsequent users. 

In addition, die TASC strategy document and other draft documents DHS 
recently provided to us are incomplete. The documents provide a high- 
level perspective of the systems comprising the TSA shared baseline and 
broad time frames for migrating various DHS components. Much more 
detailed planning is needed to ensure that DHS has a solid foundation and 
road map for this transformation effort For example, it is not clear which 
DHS component is expected to host** the TSA shm’ed baseline and what 
other services will be provided. Issues related to how this change vrill 
affect DHS’s human capital are not yet addressed. Further, the TASC 
strategy does not address the CBP baseline nor, most importantly, how 
these various systems will ultimately be unified for departmentwide 
information needs. Much more detail is needed to provide a financial 
management strategy or plan for integrating and modernizing DHS’s 
financial management systems. 

Moreover, we would like to highlight the need for a close interrelationship 
between TASC and the ICOFR Playbook. The ICOFR Playbook calls for 
policies and procedures to be developed in a variety of financial 
management areas, such as intragovemmental transactions; legal and 
other liabilities; budgetary accounting; property, plant, and equipment; and 
operating materials and supplies. It is important that these policies and 
procedures be embedded in the financial systems that are discussed in 
TASC so that rework is minimized. While the ICOFR PUiybook in 
particular continues to focus primarily on getting a “clean” audit opinion 
on DHS’s annual financial statements, getting a “clean" audit opinion, 
although important, is not the end goal. The end goal is to establish a fully 
functioning CFX) operation that includes (1) modem financial systems that 
provide reliable, timely, and useful information to support day-to-day 
decision making and oversight and for the systematic measurement of 
performance; (2) a cadre of highly qualified senior-level and supporting 
staff; and (3) sound internal controls that safeguard assets and ensure 
proper accountability. Ultimately, DHS must be able to provide reliable, 


’^Information techndogy hosting involves providing secure facility space, networks, and 
hardware to host software plications and providing the necessary personnel to operate 
this secure environment. 
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useftil, and timely financial management information so that DHS 
leadership and the Congress are well positioned to make fially informed 
deciaons to secure America’s homeland. 


Mr. Chairman, at this time I would like to point out that based on industry 
best practices, we have identified four key building blocks that will be 
critical to DHS’s ability to successfiiUy complete its financial 
transformation. Our March 2006 testimony” and, more recently, our report 
for this subcommittee, pointed out that careful consideration of these 
four concepts, each one building upon the next, will be integral to the 
success of DHS’s strategy. The four concepts are (1) developing a concept 
of operations, (2) defining standard business processes, (3) developing a 
migration and/or implementation strategy for DHS components, and 
(4) defining and effectively implementing disciplined processes necessary 
to properly manage the specific projects. Fully embracing these four 
building blocks and human capital best practices will be critical to the 
success of any future financial management system plan or strategy for 
transforming departmentwide financial management systems at DHS. We 
have continued to refine these key issues to ensure they remain closely 
aligned with DHS’s stated approach — most recently, the department’s 
TASC strategy. 

DHS also has an opportunity to reap substantial benefits by reengineering 
business processes and standardizing those processes to realize 
productivity gains and staff portability across the various components. In 
addition, identilying staff with the requisite skills to implement such 
systems and identifying gaps in needed staff skills and filling them are 
necessary to successfully implementing and operating a new financial 
management system. Any DHS financial management system 
transformation plan or strategy will be inherently complex and 
challenging, maldng the adoption of best practices even more important 
for this undertaking. Table 1 highlights the key issues to be considered for 
each of the four areas. 


”GA(K)6-553T. 
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Table 1 : Key Issues tor DHS to Consider Based on the Four Building Blocks 


Building block 

Key issues 

Concept of operations. Describe systems 
characteristics for a proposed system 
from a user’s perspective 

• Define how DHS’s day-to-day financial management operations are and will be carried 
out to meet mission needs. 

> Clarify vrtitch cc^nponent and departmentwide systems are considered financial 
management systems. 

• Include a transition strategy that is useful for developing an underatanding of how and 
when changes will occur. 

• Develop an approach for obtaining reliable information chi the costs of its financial 
management systems investments. 

• Link DHS’s concept of operations to its enterprise architecture. 

Standard business process: identify 
preferred business processes to 
standardize applications and training and 
portability of staff 

• Assign re^nsibility for developing departmentwide standard business processes that 
meet the needs of its component agencies. 

• Develop an ^proach to encourage agencies to adopt new processes rather than 
selecting other methods that simply automate old ways of doing business. 

• Provide a foundation for component efforts to describe the business processes needed 
for unique missions, or develop subprocesses to support those at the departmentwide 
level. 

Strategy for implementing the shared 
baseline approach: Utilize a detailed plan 
to consolidate financial management 
operations 

• Develop specific criteria for requiring component agencies to migrate to one of the 
shared baselines rather than attempting to develop and implement their own 
stovepiped business systems. 

• Provide the necessary information for a component agency to make a selection of a 
shared baseline system. 

• Define and instill new values, norms, and behaviors within component agencies that 
support new ways of doing work and overcoming resistance to change. 

• Build consensus among customers and stakeholders on specific changes designed to 
better meet their needs. 

• Plan, test, and implement all aspects of the transition from one organizational structure 
and business process to another. 

Disciplined processes. Reduce 
development time and enhance 
effectiveness by adopting industry 
standards and best practices 

• Incorporate industry standards and best practices into DHS-wide guidance related to 
financial management systems implementation efforts. 

• Take actions to reduce risks and costs associated with data conversion and interface 
efforts. 

• Adopt an oversight process to ensure that modernization efforts effectively implement 
the prescribed policies and procedures. 


Soofce;OAO, 


As we previously stated, effective human capital management is critical to 
the success of any transformation effort. We reported in our Executive 
Guide: Creating Value Through World-class Financial Managements^ that 
having staff with the appropriate skills is key to achieving financial 
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management improvements, and managing an organization’s employees is 
essential to achieving results. Strategic human capital management for 
financial management projects includes organizational planning, staff 
acquisition, and team development. The independent public accountants 
who conducted DIS’s fiscal year 2006 audit have stated that many of the 
department’s difficulties in financial management and reporting can be 
attributed to the originsQ stand-up of a large, new, and complex executive 
branch agency without adequate organizational expertise in financial 
management and accounting. Moreover, DHS’s Resource Management 
Transformation Office officials have stated that because of staffing 
shortages, outside contractor are currently performing some of the 
financial management activities or duties that internal DHS staff would 
normally perform. Some of the most pressing human capital challenges at 
DHS include (1) successfully completing its ongoing transformation; 

(2) forging a unified results-oriented culture across the department; 

(3) obtaining, developing, providing incentives to, and retaining needed 
talent; and (4) most importantly, maintaining leadership at the top, to 
include a chief operating officer or chief management officer. 

Having adequate and sufficient human resources with the requisite 
training and experience to successfully implement a financial management 
system is a critical success factor. Strategic human capital planning is 
necessary for all stages of a financial systems implementation. Agencies 
across the federal government face the challenge of sustaining the 
momentum of transformation because of the limited tenure of key 
administration officials. Managing the transformation of financial 
management systems at an organization the size and complexity of DHS 
requires comprehensive coordinated planning and integration of key 
management functions across all components of the department 

In our related report, released today, we made six recommendations 
focused on the need for DHS to develop a financial management plan or 
strategy and to fully adopt the building blocks and human capital practices 
that are vital to minimizing (he risk related to modernizing its financial 
management systems. In written comments on a draft of this report, DHS 
concurred with our recommendations and described the approach and 
steps that are planned to improve DHS’s financial management systems. 


Concluding 

Observations 


GAO and others have found that the key to implementing systems that 
meet cost, schedule, and performance objectives is to have effectively 
implemented the disciplined processes necessary to reduce risks to 
acceptable levels. Ending eMerge^ was a prudent decision; however, we 
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are concerned that DHS still lacks a clearly defined financi^ management 
strategy or financial management system implementation effort to even 
begin to address the integration and transformation issues highlighted in 
our most recent high-risk report. 

Given that DHS is one of the largest and most complex executive branch 
agencies in the federal government, developing, operating, maintaining, 
and transforming its financial management systems represent a 
monumental challenge. This challenge is compounded by the relatively 
recent creation of DHS and the poor condition of the range of legacy 
financial and related business systems it inherited. Critical success factoid 
for DHS’s transformation efforts will include using the four building 
blocks and human capital best practices to provide reasonable assurance 
that the risks associated with implementing a depaitmentwide integrated 
financial management system are minimized. If properly implemented, the 
recommendations included in our related report released today, which are 
based on best practices, will help reduce the risk associated with a project 
of this magnitude and importance to an acceptable level. Otherwise, DHS 
runs the risk of repeating the failure of eMerge*. At the request of this 
subcommittee, this testimony summarizes the results of our first review of 
DHS’s financial management transformation efforts. We look forward to 
continuing to work with you as we continue to monitor DHS’s efforts to 
transform its financial manj^ement systems. As DHS moves forward, your 
subcommittee’s continuing efforts to oversee the status of this 
transformation will be critical to its success. 


Mr. Chairman, this concludes our prepared statement. We will be happy to 
respond to any questions you or other members of the subcommittee may 
have at this time. 


r’ont.nrts and information about this statement, please contact McCoy Williams, 

Director, Financial Management and Assurance, at (202) 512-9095 or 
AcknOWlBdgnientS williamsml@gao.gov, or Keith A. Rhodes, Chief Technologist, Applied 

Research and Methods, Center for Engineering and Technology, at (202) 
512-6412 orrhodesk@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of tMs testimony. Individuals who made key contributions to this 
testimony include Kay Daly, Assistant Director; Chris Martin, Senior Level 
Technolo^st^ Felicia Brooks; Francine Delvecchio; and Chanetta Reed. 
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Opening Statement 

Thank you Chairman Carper, Senator Cobum and Members of the Subcommittee for 
allowing us this opportunity to testify before you regarding Financial Management 
Systems Modernization at the Department of Homeland Security (DHS). Scott Charbo 
and I are pleased to discuss with you the Department’s strategy and progress in 
transforming and consolidating financial management systems throughout the 
Department. We also appreciate the work done by the Government Accountability 
Office (GAO) and concur with all six of their recommendations. 

The Department of Homeland Security was formed from the merger of 22 distinct 
agencies. Given our origin, it is not surprising that we would have multiple financial 
systems. In the long run, however, this is not cost effective. Too many systems 
complicate financial reporting, internal controls, system security and software 
maintenance. 

In 2003, to address this problem, the Department began an initiative called eMerge^ and 
contracted out for the development of a financial solution that integrated finance, 
accounting, procurement and asset management systems. That integration effort ran 
into technical challenges and, as GAO describes it, the Department made a “prudent” 
decision to cut its losses. 

This, however, is not the end of the story. With Department approval, Customs and 
Border Protection (CBP) successfully implemented the SAP financial package that 
includes finance, accounting, procurement and asset management. This strengthened 
CBP’s financial reporting and its internal controls processes and last year CBP received 
an unqualified opinion on its financial statements. 

At about the same time, the Transportation Security Administration (TSA) needed to 
migrate off of the financial system it used at the Department of Transportation. In 
response the United States Coast Guard provided TSA an Oracle package that also 
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included procurement and asset management. Other offices expressed an interest in 
this solution and over the last two years the Department has migrated the Federal Air 
Marshal Service (FAMS - realigned from ICE to TSA in FY06) and the Domestic 
Nuclear Detection Office (DNDO) to the same solution. While TSA is still addressing 
some material weaknesses, it is not the system that stands between them and a clean 
audit opinion. 

When you review the different systems the Department has, these two agency’s 
solutions stand out. They use core accounting applications that are also used by other 
large federal agencies with unqualified audit opinions. They were successfully and 
broadly implemented inside DHS, so we have people who are experienced with the 
applications. The products are also commercially available and supported by multiple 
vendors, which promotes competition. 

Transformation and Systems Consolidation (TASC) 

So rather than pursue the acquisition, configuration, and implementation of a new 
system within DHS, we will leverage our existing investments by continuing the 
migration of Components to these two proven financial management systems. We have 
briefed this initiative, called Transformation and Systems Consolidation (TASC), to the 
Office of Management and Budget (0MB) and we meet with 0MB routinely to discuss 
progress. 


The next stage of the consolidation plan will begin with the migration of small 
Components such as the Office of Health Affairs (OHA) and Science and Technology 
(S&T). The goal is to repeat, refine and build upon each successful migration. The plan 
will continue with the migration of larger Components such as the Federal Emergency 
Management Agency (FEMA) and Immigration and Customs Enforcement (ICE). By 
Fiscal Year 2009, we expect 50 percent of DHS Components to be on the consolidated 
financial management systems. By Fiscal Year 2011, we expect 97 percent of the 
Department will be on these systems. After the completion of this consolidation plan 
(Phase 1), a single Baseline will be chosen. Migration onto a single Baseline will then 
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be planned and implemented. The Department is committed to a single Baseline as the 

end state for its financial management needs. 

Key Benefits 

There are a number of financial and performance benefits associated with TASC. 

These include: 

. A reduction in maintenance costs, freeing internal resources from the 
maintenance of outdated, highly customized systems; 

• A significant cost-avoidance for future integration expenses. For example, 
integrating a new Department-wide travel or grants management system would 
require the development of fewer interfaces, realizing a significant cost- 
avoidance; 

• Promoting competition for systems operation and maintenance services which 
eliminates the financial risk associated with reliance on a single vendor. 

TASC also provides DHS with: 

• More accurate, timely and reliable financial data; 

• The foundation for effective internal controls and segregation of duties supported 
by a compliant software system; 

• Real-time interoperability across the financial management enterprise, improving 
operations and leveraging investments; 

. An approved Chart of Accounts compliant with the United States Standard 
General Ledger (USSGL); 

• A reduction in reporting errors via the removal of manual processes, yielding 
streamlined financial reporting in a more secure environment; 

• Support of the Secretary's priority to unify IT infrastructure; and 
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• Support of the President's Management Agenda (PMA) framework, which 
strengthens Department-wide financial accountability. 

TASC overall meets DHS' requirements to provide better mission support through 
efficient integration of financial, accounting, procurement and asset management 
operations and moves DHS closer to a sustainable, unqualified audit opinion. 


Responding to GAO Recommendations 

This approach is consistent with GAO recommendations for strengthening DHS 
financial management. For example, we recognize that the success of TASC is 
predicated on having a disciplined set of processes from requirements to acceptance. 
To this end, we developed key program documents early in the program that detail the 
strategies, plans and processes for all of the areas cited in the GAO report including 
Program Management, Configuration Management, and Quality Management, in 
addition, we developed strategies, plans and processes for Architecture Management, 
Change Management and Communications, Independent Verification and Validation 
and Contract Deliverables. 


We further acknowledge the importance of another key document, the Concept of 
Operations (ConOps). The Resource Management Transformation Office (RMTO) is 
currently drafting an IEEE compliant update to the ConOps developed from the previous 
migrations of TSA, FAMS and DNDO. This ConOps describes the current business 
processes and technical specializations of the system. As components migrate, the 
ConOps will describe how the migrating component will use the system to support its 
business processes. 


The Department also has efforts underway to reengineer and standardize key business 
processes. This includes the A-123 review which is part of our internal controls 
processes, as well as the creation of a Department-wide financial policy manual. The 
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selected systems provide effective and efficient operations and reliable financial 
reporting to include transaction-level detail and system-controlled segregation of duties. 
One example is the ability to perform an automated funds check. The system will check 
the general ledger account to ensure that funds are available prior to a purchase 
request being released in the system. 

Additional information on how we have addressed the six recommendations is included 
in our Management Response to the GAO Report. 


Financial Management Improvement Initiatives 

As we move forward with TASC, we recognize that other initiatives significantly 
contribute in transforming the Department. While systems consolidation will provide the 
technological foundation to many of these efforts, our financial management 
improvement strategy is centered on the broader framework of People, Policy, Process, 
Systems and Assurance. For example, 

• In March, we launched our new hire orientation program. Sixty-seven DHS 
accounting and budget staff from across the country completed the inaugural 
program, which provided targeted training on the budget cycle, financial systems, 
contracting, internal controls and fiscal law. The program not only provides a 
foundational level of financial management knowledge but also supports the 
framework for a unified financial management culture. It is now required for all 
new hires in DHS financial management. The next orientation is scheduled for 
the end of August. 

• This winter we completed the first cycle of the CFO Mentorship program, to 
develop a pipeline of strong candidates with leadership competencies for senior 
financial management roles throughout the Department. Five managers from 
CBP, ICE, FEMA, TSA and DHS Headquarters completed the 4-month program 
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consisting of component rotations and residential training. We are now accepting 
applications for our fall and winter sessions. 

• We are developing a department-wide financial management policy manual to 
instill best practices and consistency in the execution of ail DHS financial activity. 
We have conducted 30 policy workshops so far and drafted 40 new policies in an 
effort to complete a web-based, searchable manual by summer 2008. 

• Finally, we released the Internal Controls Over Financial Reporting (ICOFR) 
Playbook which outlines our strategy and process to resolve material 
weaknesses and build management assurances. This is a critical initiative that 
supports, but should be not be confused with, the systems migration. 


Conclusion 

Modernizing financial management systems is an inherently complex and challenging 
endeavor. It requires careful planning, patient implementation and strong collaboration 
among senior leaders. The strategy we have described today provides for improving 
financial systems by migrating components to existing DHS systems that are proven 
and for which we have a record of success in implementation. I am confident that 
working together we will be successful. Thank you for your leadership and your 
continued support of the Department of Homeland Security. 
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Question#: 

1 

Topic: 

Emerge 

Hearing: 

Financial Management Systems Modernization at the Department of Homeland 

Security: Are Missed Opportunities Costing Us Money? 

Primary: 

The Honorable Thomas R. Carper 

Committee: 

HOMELAND SECURITY (SENATE) 


Responses to Questions from David Norquist 


Question: The Electronically Managing Enterprise Resources for Government 
Effectiveness and Efficiency (Emerge!) program began in January 2004 to integrate 
financial management systems across the Department. GAO testified that the 
Department could not determine or support the cost of $52 million spent on the Emerge! 
project. Prudently, you declared the project “dead” before spending an estimated $229 
million on a system that would not provide the desired functionality or performance. 

How will you prevent wasting money, time, and effort on future projects? 

Where is the remaining $150 million from the Emerge! project? 


Answer: 

How win you prevent wasting money, time, and effort on future projects? 

Unlike eMerge!, the Transformation and Systems Consolidation (TASC) plan leverages 
successful implementations of proven applications - SAP and Oracle Federal Financials 
- to which Department components will be migrated. SAP and Oracle are market leaders 
in financial management software in the Federal space and leveraging these existing 
systems will allow the Department to increase the transparency of its financial data and 
accountability to Congress and the American taxpayer. 

The TASC approach reduces the cost of building or configuring a new system from 
scratch and leverages the Department’s current systems investments. Consolidation also 
means avoiding the future costs of multiple integrations for system initiatives and 
upgrades like eTravel and NFC (payroll). 

The TASC approach also yields significant savings in time and effort. Since the systems 
are already successfully in use at Customs and Border Protection (CBP) and the 
Transportation Security Administration (TSA), we know the systems and are repeating 
proven and successful migration processes. Also, under TASC, we are systematically 
applying a phased migration approach which allows us to utilize lessons learned from 
previous migrations in all subsequent migration efforts. The phased migration approach 
promotes greater understanding of the Components’ business processes and provides for 
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1 

Topic; 

Emerge 

Hearing: 

Financial Management Systems Modernization at the Department of Homeland 

Security: Are Missed Opportunities Costing Us Money? 

Primary: 

The Honorable Thomas R, Carper 

Committee: 

HOMELAND SECURITY (SENATE) 


flexibility in sequencing Component migrations (i.e., if one component is not ready to 
begin a migration, we will move another). 

Where is the remaining $150 million from the Emerge! project? 

While the five-year life cycle costs were projected at $252M including development, 
implementation, operations and maintenance, and program support costs, the vast 
majority of the projected cost was never requested from or appropriated by Congress. 

The Department had $43M of unobligated fonds at the end of Fiscal Year (FY) 2006. 
Consistent with Congressional direction, the unobligated balances from the eMerge2 
project will fund the following activities in FY 2007 and FY 2008: 

1. Creation of Financial Management Policy Manual ($],5M)-DHS recognizes the 
importance of standardizing processes and procedures throughout the Department 
in order to improve financial management knowledge, ensure compliance, 
enhance data accuracy, promote accountability, and sustain internal controls. We 
are building a web-based comprehensive set of financial management policies, 
which is planned for roll out in summer of 2008. The policy database will be 
searchable and will incorporate best practices from other agencies and 
departments. 

2. Financial Systems Consolidation ($2 1 .2M) - This is the TASC initiative that is 
described in the first part of the question. These investments will be in the form 
of upgrades to existing systems; new functionality and interfaces; and 
consolidation to a shared baseline. 

3. Expanding of a Shared Baseline ($9M) - This funding provides for the standup, 
assessments, hosting and investments in a DHS shared baseline. The shared 
baseline provides DHS with a viable system for Components of DHS on which to 
migrate. 

4. Business Intelligence ($2.6M) - This initiative improves existing reporting 
processes and capabilities, such as the monthly obligation report that is sent to 
Congress. With improved reporting capabilities and increased data visibility, we 
will be able to more easily and accurately monitor and track budget and financial 
management information across DHS. 

5. Program Management ($5.8M) - The Resource Management Transformation 
Office (RMTO) is the program management office that is charged with leading 
and managing the system consolidation effort and the establishment of a Shared 
Baseline. Program management investments include program and project 
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oversight, Earned Value Management, and contract administration for RMTO 
programs. 

6. Certification and Accreditation (C&A) and Independent Verification and 

Validation (IV&V) ($3M) - We will ensure that C&A activities are conducted to 
ensure that our financial systems meet the documented security requirements and 
maintain the accredited security posture throughout their lifecycle. To ensure the 
quality of our systems, we will conduct IV&V activities to ensure that 
requirements are satisfied and deliverables meet the defined objectives. 




50 


Question#: 

2 

Topic: 

TASC 

Hearing: 

Financial Management Systems Modernization at the Department of Homeland 

Security: Are Missed Opportunities Costing Us Money? 

Primary: 

The Honorable Thomas R. Carper 

Committee: 

HOMELAND SECURITY (SENATE) 


Question: You have already embarked on a new project - the Transformation and 
Systems Consolidation (TASC) - without fully implementing the GAO’s 
recommendations released in their report today. 

How will you avoid repeating the Emerge2 failures? 

How will the Department incorporate lessons learned to avoid unnecessary spending on 
projects doomed to fail? 

Answers: 

eMerge2 began with thousands of requirements and then asked the contractor to 
implement a new system to meet them. For TASC, we are starting with existing systems 
and performing gap analyses to understand what , if any, needs the Department might 
have that this system cannot meet. In addition, we are conducting the migrations in 
phases using a proven methodology. We have already successfully migrated the 
Transportation Security Administration (TSA), the Domestic Nuclear Detection Office 
(DNDO), and the Federal Air Marshal Service (FAMS) to the Shared Baseline and we 
are able to use lessons learned for future migrations. In addition, by using the phased 
approach under TASC, we will be starting with smaller Components and incorporating 
lessons learned as we move forward. 

With regard to GAO, we concur with their findings and we are currently implementing their 
recommendations. In this regard, we are developing a detailed plan to migrate Components to 
proven financial systems baselines within the Department. As part of this plan, we have 
developed many of the documents required for execution of TASC including the Project 
Management Plan, Analysis of Alternatives, Software Development Life Cycle, comprehensive 
migration schedules, Acquisition Plan, and Risk Management Plan. In addition, as 
recommended by GAO, we are modifying the Concept of Operations (CONOPS) document to 
conform to Institute of Electrical and Electronics Engineers (IEEE) standards. This CONOPS 
will be a living document and will be updated for each migration to reflect lessons learned from 
previous mipations. 

Also in line with the GAO’s recommendations, we are standardizing business processes 
across the Department including applicable internal controls to support 0MB A- 123 
compliance. We are also using disciplined processes to minimize project risk in the areas 
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of program management, configuration management, and quality assurance. We will 
continue to reengineer our business processes throughout the project lifecycle. 

To ensure the quality of the work completed under TASC, we are requiring CMMI III 
certification from our future industry partner and are following a performance-based 
approach to contracting which ensures the government only pays for the deliverables 
received. We are also using the Earned Value Management (EVM) approach to 
objectively measure our project progress and ensure that the contractor deliverables have 
value to the government. Also, with staff experienced in leading successful consolidation 
effort, the Resource Management Transformation Office (RMTO) is well-positioned to 
manage the large-scale effort required under TASC. 
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Question: One of the primary issues raised in this GAO report deals with human capital 
challenges at the Department. 

Mr. Norquist, when will the Department complete a comprehensive assessment of its 
human capital needs? 

What type of persoimel is needed to accomplish your financial management goals? 

How will you obtain these staff? 

Mr. Norquist, in a recent briefing to committee and subcommittee staff, you laid out your 
plans and program for developing future leaders from within your shop. 

Should this program be replicated in other areas within the Department? 


Answers: The Department has conducted extensive assessments of its workforce needs. 
In this regard, we have identified 1 1 5 occupations and relevant competencies key to our 
success, as well as hiring targets for mission critical occupations. We have also 
conducted department-wide career expos and recruitment events to educate and attract 
professionals to occupations that are found across the Department (e.g., IT and 
acquisition professionals) and developed career paths to create opportunities for 
professional growth in the Department. 

To complement our hiring initiatives, our Chief Human Capital Officer has developed a 
Learning and Development Strategy that outlines a series of educational and training 
opportunities in four areas of emphasis including: the Leadership Institute, Preparedness 
Center, Homeland Security Academy, and Academic Outreach. 

We recently completed a human capital assessment in the Department’s Office of 
Financial Management to help us improve the quality and efficiency of DHS financial 
reporting. 

We seek candidates with the specific skills needed to help us achieve our financial 
management goals which includes, accounting, budget formulation, cost analysis, 
financial systems and audit experience. In addition, we look for people with a strong 
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understanding of federal laws, regulations, and financial management policy. The 
Department also encourages current and prospective employees to achieve and maintain 
certifications such as: Certified Government Financial Manager, (CGFM), Certified 
Public Accountant (CPA), Certified Management Accountant (CMA), Certified Internal 
Auditor (CIA), Certified Financial Manager (CFM) or Project Management Professional 
(PMP) - to name a few. 

We have used a number of efforts to successfully recruit additional staff. We attend key 
trade conferences to distribute DHS OCFO recruiting materials and talk with potential 
candidates about the benefits and opportunities of working at DHS. We participate in job 
fairs and have established a recruiting address for potential OCFO candidates to submit 
their resumes (CFOjobs@dhs.gov). We also emphasize training for our current staff 
including the New Hire Orientation Training and the CFO Mentorship Program. 

The CFO Mentorship Program and New Hire Orientation Training are in their second 
cycle and we continue to incorporate lessons learned. We have received positive 
feedback from participants and Components about both of these programs. 

We launched the CFO Mentorship Program to develop a pipeline of strong CFO 
candidates with leadership competencies for senior financial management roles 
throughout the Department. This type of program does have broader application and 
some of the Department-wide programs mentioned above also have mentoring and 
rotational assignments built into the requirements. The CFO will continue to work with 
the Chief Human Capital Officer to incorporate lessons learned from the CFO 
Mentorship Program into the programs implemented across the Department. 
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Question: Many federal agencies, including the Department, have hired contractors to 
provide expertise in information technology transformation efforts, yet GAO continues to 
report that many of these projects fail to achieve their cost, schedule, and performance 
goals. 

Do contractors fill a role other skilled staff could play? 

How many contractors work with you at the Department? 

How many contractors total has the Department brought on board? 


Answers: Contractors provide specific, necessary technical expertise within the OCFO. 
The CFO's Resource Management Transformation Office (RMTO) is the program office 
for the Transformation and Systems Consolidation (TASC) initiative. This is the 
DHS financial system consolidation effort. A Solutions Architect contracted through the 
DHS Eagle procurement vehicle will be tasked with COTS application support and 
provide COTS application expertise. 

The RMTO Office currently employs 14 full-time contractors. Many of these 
professionals have been assisting the RMTO office for several years. Specific technical 
roles include: Chief Architect, Information Systems Security Officer, Independent 
Verification and Validation and Compliance Program Support. These professionals are 
in addition to the Solutions Architect team that has the responsibility to deliver the 
solution. 

Strong government oversight is essential. All contractors are under the supervision of 
federal, COTR-certified management. We will continue to increase the size of the 
government workforce as appropriate to keep pace with the task initiative. Contractor 
performance is reviewed regularly to ensure performance goals are met. Additionally 
new contract awards are performance-based. If the contractor does not deliver, the 
contractor does not get paid. 

We often acquire support on a fixed price basis or based on performance objectives. The 
number of persotmel the contractor employs is often not available since we are paying for 
a deliverable or outcome rather than man-hours. In those instances where DHS is 
acquiring a specific “level of effort” or man-hours, contractors may use several 
employees to accomplish tasks that total the number of man-hours in one FTE. Thus, it is 
not possible to track or provide this information Department-wide. 
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Question: During the hearing, you stated that the CFO’s budget was about $20 million and that 
about $8 million of this was for contractors. 

Please provide the amount of funds budgeted or expected to be budgeted for all of the 
Department’s financial management operations for fiscal years 2007 and 2008 and the portion of 
those funds that are expected to go to contractors. (We would like this broken out by major 
component, e.g., Coast Guard, TSA, Customs, etc.) 

In addition, please identify the amount of funds expected to go to contractors under “no bid” or 
sole source contracts. 


Answer: The tables below detail by Component, the funds budgeted or expected to be budgeted 
for contractor support for DHS’s financial management operations in 2007 and 2008. The 
figures in the tables are in millions of dollars. 

Of the $8 million that was put on contract from the CFO’s budget, two were sole source. One 
was a contract for administrative support in the amount of $304,000. This contract was a small 
disadvantaged business contract authorized under 8A. The other sole source contract was with 
General Dynamics IT in the amount of $482,000. This contract involved the customization and 
configuration for the OCFO of an electronic Project Management Office system already owned 
and used by the US Coast Guard. 
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Question: One of the advantages cited during the hearing in consolidating the financial 
management systems is reduced support costs. 

Please provide the amount of funds that are have been spent during fiscal year 2007 and 
are expected to be spent during the next four years for major system upgrades and 
whether any of those funds are reflected in the fiscal year 2008 budget submission. (For 
example, it is our understanding that Customs is planning to upgrade its SAP 
application.) How much is this expected to cost and when is it expected to occur? 

Please provide the principal appropriation accounts that are used to pay for financial 
management operations. 


Answer: The TASC initiative targets the system migrations over the next five years, 
four years. The amount outlined in our Expenditure Plan for TASC migrations for Fiscal 
Year (FY) 2007-201 1 is S45.6 M. The projected annual breakdown is as follows: 

• FY07: $11. 9M 

• FY08: $9.3M 

• FY09-11: $24.39M 

The amount of funds spent for major system upgrades are as follows: 

Customs and Border Protection (CBP) has not performed any major system upgrades 
in 2007 and has no plans for any new major system upgrades over the next four fiscal 
years. Annual maintenance costs with SAP and any development/configuration work that 
might be required is funded out of our existing base funding to support the system. 

Immigration and Customs Enforcement (ICE) has not spent any funds for major 
Financial Systems Upgrades in FY 2007 and is not planning to do so in FY 2008. 
Spending in the out years will be targeted towards their migration to a Department 
baseline. 

The Federal Emergency Management Agency (FEMA) has spent $1,606,570 in FY 
2007 for system upgrades. In FY 2008, FEMA has budgeted $8,600,000 for migration of 
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Grants and Training (G&T) to FEMA’s IFMIS; $4,000,000 for IFMIS enhancements; 
and $2,600,000 for IFMIS maintenance. FEMA has budgeted $1,153,000 for FY 2009 
system upgrades; $1,163,000 for FY 2010 system upgrades; and $1,174,000 forFY 2011 
system upgrades. G & T is currently running a version of IFMIS which is different from 
the version of IFMIS the rest of FEMA is running. To facilitate the migration of FEMA 
to the shared baseline, it is prudent for all of FEMA to be running the same version of 
IFMIS. 

The Federal Law Enforcement Training Center (FLETC) monies spent on licenses 
and technical services for Momentum and Procurement Desktop for FY 2007 through 
June 30th is $542,483.71. The amount obligated for FY 2007 for these services is 
$827,000.00. The remaining unbilled contract balance is $284,516.29. 

The FY 2007 Momentum upgrade monies committed is $2.49 Million. FLETC expects 
to incur the same amount for the next four years for upgrades. Recurring costs for 
licenses and technical services for Momentum for the next four years is estimated at 
$800,000 per year. 

The United States Secret Service (USSS) has not spent any funds for FY 2007 on major 
system upgrades and does not have any planned during the next four years. 

The Unites States Coast Guard (USCG) will spend $9M in FY 2007 for system 
upgrades. It projects an $8M upgrade in FY 2008 and a $5M upgrade in FY 2009. The 
USCG has no projected upgrade costs for FY 2010 and FY 2011. The projected costs for 
system upgrades include technology, as well as process improvements and costs 
associated with addressing deficiencies identified in the financial audits. Many of these 
issues cannot be resolved by simply changing to the TASC Oracle baseline (TSA 
baseline). 


Regarding the principle appropriation accounts, this information is not tracked centrally 
at the Department level. Components have varying models of how these costs are paid 
for within their organization. While some Components pay for these services through a 
centralized M&A account, others have a different cost distribution model. Regardless of 
the source of the costs, the cost savings would be applicable to their individual models. 
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Question: A common theme that we hear about in federal agency information technology 
modernization efforts is the need for sustained leadership. That leadership needs to have 
a vision of the department as a whole. It has been suggested that for large complex 
agencies, such as the Department, that an individual should be designated to provide 
overall responsibility and accountability for agency modernization efforts. 

What accountability mechanisms are in place to make sure the Department’s leaders (like 
you) are making progress on financial management modernization? 

Answer: DHS has established an Enterprise level program management office to plan 
and execute the financial management modernization, the Transformation and Systems 
Consolidation (TASC) Program Management Office. TASC is run by a certified Program 
Manager and is staffed with appropriate supporting personnel. The continuity of the 
TASC Program is assured regardless of changes in DHS senior leadership. 

The TASC Program Manager reports to the Chief Financial Officer and also receives 
oversight from the Chief Information Officer who controls the budget that supports the 
modernization effort. The CFO and CIO are accountable to the Under Secretary for 
Management, who is in turn accountable to the Deputy Secretary and Secretary of DHS. 
Key TASC program milestones are tracked and reported under the Secretarial Priority 
Goal entitled “Strengthen and Unify DHS Operations and Management.” Progress 
against this Secretarial Goal is briefed periodically to the 0MB, 

Currently, DHS uses several integrated decision support processes and supporting 
governance authorities to manage and oversee the DHS IT Portfolio. Principal IT 
investment management processes include the following: 

• Capital Planning and Investment Control (CPlC); 

• Information Technology Investment Review Process (IRP); 

• Enterprise Architecture/Program Analysis Decision Review; 

• DHS Systems Development Life Cycle Guide; 

• Information Technology Acquisition Approval Process; 

• Information Technology Budget Review Process; and 

• Information Technology Portfolio Management, 

In conclusion, the financial management modernization at DHS has clear accountability 
through the appropriate management chain to the DHS Secretary, The TASC Program 
Management Office is an Enterprise entity and executes a departmental strategy 
promulgated by the DHS Secretary. Governance processes are in place to ensure that the 
TASC program is managed effectively throughout the lifecycle and regardless of changes 
in leadership. 
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Question: During the Emerge2 program, the Department had identified over 7,000 
system and business requirements. Department officials believe many of these 
requirements are reusable for future information technology projects. However, GAO 
has raised concerns about whether any of the 7,000 requirements are salvageable. 

In your view, what requirements can be reused for future projects? 

How did you reach that decision and who was involved in the decision-making process? 


Answer: The requirements from the eMerge2 program can be used as a reference and as 
a baseline for a point in time. They provide a valuable view and understanding of the 
systems the Department inherited. Although each requirement is not of equal weight, it is 
a basis for evaluating and moving forward. The Department achieved a greater 
understanding of the needs and desires of the components through the requirements 
process as well as a clearer understanding of the state of financial management in the 
Department. 

We looked at the eMerge2 artifacts, looked at the process used during previous successful 
migrations along with the associated documentation and made a determination about our 
future approach. The CFO, RMTO and the components were involved in the decision 
making process. 
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Question: GAO said the Department needs to follow systematic methods or “disciplined 
processes.” 

Does the Department use systematic methods in its information technology development 
efforts? 

Can you describe them? 

Answer: 

The Department has developed and implemented several processes to effectively manage 
IT investments. For example, the Department issued a Management Directive earlier this 
year which provided the DHS Chief Information Officer with the authority to review and 
approve the Department’s entire information technology budget. 

The Department also requires programs to submit Periodic Reporting (PR) information 
for all major investments on a quarterly basis. In addition, the Department published and 
distributed Periodic Reporting (PR) Guidance in the first quarter of Fiscal Year 2006 and 
provided associated training courses to personnel within the DHS Program Management 
Offices (PMOs). The Department implemented Earned Value Management (EVM) and 
Operational Analysis (OA). Guidance documents for these two processes were 
developed, vetted and implemented throughout the Department. These processes have 
led to more effective management of IT investments by significantly improving tracking 
and reporting of investment costs, schedules, and performance variances. The analysis 
from these processes has been provided to GAO. 

The Department is also currently deploying a business tool that will enable DHS 
management to view trends of quarterly Periodic Reporting (PR) information. In this 
way, senior DHS officials will be able to assess the performance of the systems and 
enhance supervisory oversight of IT investments. 

In addition, the Department has already implemented an IT acquisition review (ITAR) 
process to improve the alignment of IT purchases to the homeland security mission and 
Department architecture. The ITAR process requires that the DHS CIO review and 
approve IT acquisitions of $2.5M and greater, while component CIOs are authorized to 
approve IT acquisitions of less than this value. The ITAR process has thus improved IT 
management by providing the DHS OCIO with supervisory control over IT investments 
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and identifying duplicative investments. Over the first six months of its implementation, 
the ITAR process has been successful in reviewing 189 IT Acquisition Requests 
representing over $2B in IT investments, 

DHS has also implemented the IT Portfolio Management Process, whereby the 
Department developed and applied portfolio tools, methodologies, and techniques to 
assist in making sound IT investment decisions based on quantifiable measurements. The 
Portfolio Management program incorporates specific management processes to establish 
performance goals, transition plans, architectural targets, and performance measures. In 
this way, the Department can continue to govern the balance of investments to more 
effectively meet Departmental goals and objectives. The IT Portfolio Management 
Process has already been used to assist the DHS CIO in selecting and prioritizing IT 
investments based on alignment to DHS Enterprise Architecture. 

The Department has made great strides in developing an Enterprise Architecture (EA) 
that substantially meets each of the Enterprise Architecture Management Maturity Board 
(EAMMF) elements. Indeed, an August 2006 GAO report (GAO-06-831) found that 
DHS fully satisfied 24 out of 31 applicable EAMMF elements, and partially satisfied four 
additional elements. Since that time, DHS has taken additional steps to identify and/or 
address the final three elements. Products related to the EA are now required to undergo 
independent verification and validation (IV&V) which will ensure interoperability, 
compatibility, and efficiency within the larger structure. DHS has also worked to 
centralize IT processes and avoid unnecessary duplication, by requiring adherence to the 
EA for all IT investments over $2,5 million. 

In developing its EA, the Department sought significant input from, and consulted with, 
key stakeholders. In fact, stiieholders provided more than 400 comments on the EA, and 
DHS considered each one. GAO officials appear to have disregarded this extensive 
consultation in preparing this GAO Report, as well as the GAO report from last May (07- 
564), entitled DHS Enterprise Architecture Continues to Evolve. In 07-564, GAO 
inaccurately alleged that the Department failed to consult with stakeholders; this is 
simply not the case. 

In evaluating the comprehensiveness of the EA developed by the Department, it should 
be noted that the Office of Management and Budget (0MB) has rated the Homeland 
Security Enterprise Architecture (HLS EA) 2007 as a 4,3 on a 5,0 scale for completeness. 
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Question; One of the issues that has arisen at the Department of Defense in its 
modernization efforts involves the issue of each Department of Defense service branches 
controlling its own information technology funding which has lead to duplication of 
efforts and delivery of systems that are error prone. 

Would it help you to control your information technology finances centrally? How? 

Can Congress help? 

Answer: DHS has a Working Capital Fund which is used to align budget dollars from 
component budgets in support of Enterprise consolidation and transformation efforts. In 
addition, the DHS CIO is working with the DHS CFO to develop a solution to reduce the 
high capitalization rate necessary for migrating the components’ data centers to the DHS 
enterprise data centers. Approximately $300 million will be required to ensure the 
successful transition of all the components’ systems and applications to the new 
enterprise data centers. The Department is looking at what should be funded or managed 
centrally and what should be included in the Component’s budget. 
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Question: GAO has raised concerns about the ability of the Department’s components to 
provide shared service operations (travel voucher processing, vendor payments, 
transaction processing, etc) in light of the material internal control weaknesses that 
prevent the Department from being able to produce reliable, useful, and timely financial 
information. 

How do the different components at the Department provide transaction processing and 
financial information in a secure manner? 


Answer: The Department’s seven disparate financial systems create challenges in 
providing transaction processing and financial information in a secure manner. Our 
recent audit report showed the following security weaknesses, six of which are the Chief 
Information Officer’s responsibility: 

1 . Entity- wide security program planning and management; 

2. Access controls; 

3. Application software development and change control; 

4. System software; 

5. Segregation of duties; 

6. Service Continuity; and, 

7. Application controls. 

The Offices of the Chief Financial Officer (OCFO), the CIO, and the Chief Information 
Security Officer (OCISO) are united in our resolve to strengthen financial systems 
security. We have held joint corrective action status meetings with each component 
CFO and CIO, developed tools to integrate 0MB A-123 requirements into the OCISO’s 
Federal Information Security Management Act (FISMA) compliance process for CFO 
designated financial systems, and required components to assign dedicated Information 
Systems Security Officers to CFO designated financial systems to ensure dedicated 
resources are assigned to perform financial system security responsibilities appropriately. 

With the implementation of the TASC initiative, consolidation from seven to two systems 
will help solve this challenge. Under TASC, financial systems consolidation is controlled 
centrally to yield the standardization of business processes and to provide the systems 
backbone for strong internal controls. This central control will help ensure that 
transaction processing and financial information will be provided in a secure manner. 
Additionally, a better financial system will help improve timeliness and accuracy of data, 
strengthen internal controls, reinforce segregation of duties, and strengthen financial 
management security. 
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Question: Mr. Norquist, you recently shared the Internal Controls Over Financial 
Reporting Playbook with committee and subcommittee staff. The Playbook is the 
Department’s roadmap for implementing corrective actions for internal control issues 
identified by its auditors. We found that it contained some very good information such as 
identifying (1) the root causes of issues, (2) key strategies for each area, and (3) a high 
level methodology overview. However, there were some areas that were not adequately 
addressed regarding the resources needed to complete corrective actions. For example, 
the Playbook did not identify the number of staff, contractors, amount of funds, or key 
stakeholders from offices outside of the Mr. Norquist’s shop. GAO also expressed 
concerns in their report. 

You recently shared your Playbook with committee and subcommittee staff, which we 
found very useful in understanding the challenges that the Department faces. One item 
not included was the resources needed to resolve the outstanding issues. 

What are the resources you need? 

Have these been identified elsewhere? 

Do you have plans to incorporate this information in future versions of the Playbook? 


Answer: Each organization is responsible for providing the resources necessary to 
implement these corrective actions. While certain corrective actions can be linked to 
specific findings, most are labor intensive and depend on government staff. Frequently, 
the full level of effort is not known until the corrective action is underway. I am grateful 
to the Congress for the resources provided to us to improve Department-wide internal 
controls consistent with the DHS Financial Accountability Act (DHS FAA). The 
resources provided in our Fiscal Year (FY) 2006 and 2007 budget submissions made the 
effort possible. For example, five of the FTEs were used to form the Internal Controls 
Program Management Office (PMO). The PMO has contributed to stabilizing the 
Department’s control environment and providing components an appropriate level of 
financial management oversight through our Department-wide internal control 
assessments. In our FY 2008 budget submission, the President requested an increase of 
$2,500,000 to bolster our activities in the areas of: 
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• Improving efforts to prevent and report on improper payments; 

• Performing Assurance Team Inspections; 

• Conducting Department-wide business process reengineering workshops; 

• Implementation of corrective actions resulting from the DHS Office of Financial 
Management Human Capital and Organizational Design Study; and 

• Support for conducting independent verification and validation (IV&V) of 
component corrective action efforts. 

I would appreciate your support for the President’s Budget request. 
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Question: We have been told that the long-term vision of the Department is to 
consolidate its financial management systems down to 2 from about 500. According to 
the Department’s written testimony, they will move to Phase 2 and move the entire 
department to one financial management system. It is not clear what they mean by Phase 
2 . 

How will consolidating down to two systems and then down to one address the 
Department’s program operations needs, as well as its financial reporting needs? 


Answer: Phase 1 is the Department’s four-year vision to consolidate to two existing 
financial systems successfully implemented within the Department: Oracle Federal 
Financials and SAP.' This is the Transformation and Systems Consolidation (TASC) 
initiative we outlined at our June 28 hearing. Per our testimony, consolidating to two 
systems is in alignment with GAO’s recommendations for systems consolidation and will 
yield measurable benefits such as: 

1. Standardize business processes; 

2. Consolidate business operations across the Department; 

3. Improve timeliness and accuracy of data; 

4. Strengthen internal controls; 

5. Reduce cost of multiple interfaces to multiple systems; and, 

6. Strengthen security in financial management. 

As the consolidation is completed, my successor will assess the current state of 
technology and determine which single financial system will best support the 
Department, Given the rapid change in technology and the time it will take to 
consolidate into two systems, a decision to which single financial system will migrate 
will need to wait for my successor. This decision will begin Phase 2 of the TASC 
initiative. 


' As part of the long-term vision for TASC, after the Phase 1 migrations are completed, FLETC will be 
under consideration to move to one of the baselines. 
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Question: 0MB has recently taken over the responsibilities of the former Joint Financial 
Management Improvement Program (JFMIP) to perform tests on financial management 
systems or packages used by agencies to ensure that the packages met a set of “core 
requirements.” Once the financial management packages pass the tests, 0MB certifies 
them as “JFMIP compliant” and ready for use by the agencies. However, GAO has 
reported that agencies that have implemented these “certified” packages still had 
significant problems. 

Have these “certified” systems helped the Department? 


Answer: The Financial Systems Integration Office (FSIO), formerly the JFMIP, is a 
division within GSA that has government-wide responsibilities for core financial system 
requirements development, testing, and certification. 

The FSIO certified systems are helpful to the Department because they guide vendors to 
produce software that considers Federal government’s requirements, and as a result, 
eliminates the need to develop a custom system. FSIO does not dictate module 
configuration guidelines, but rather certifies that products ‘can be’ configured properly. 
However, use of the certified systems alone does not guarantee a successful 
implementation. 
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Question: GAO and the Department auditors have reported since its inception that 
internal control and financial management weaknesses have prevented the Department 
from implementing successful financial management systems that improve Department 
business operations and provide accurate and reliable day-to-day financial and 
performance information. For fiscal years 2006 and 2005, the Department auditors were 
unable to provide and opinion on the Department consolidated financial statements. 
GAO points out in its report that achieving a “clean” opinion is not the end game. The 
Department needs to resolve its outstanding internal control issues. 

How will obtaining a clean opinion on the Department’s financial statements impact its 
financial management modernization? 


Answer: They need to move together. The TASC initiative will provide the systems 
backbone to strengthen internal controls. Improving timeliness, accuracy and 
transparency of data will make system migrations easier. 

To achieve this, the Resource Management Transformation Office (RMTO) is working 
lockstep with the Office of Financial Management to link systems modernization efforts 
with the Department’s Internal Controls Over Financial Reporting (ICOFR) Playbook. 
Together, both initiatives will align system solutions with internal controls to support 
0MB A-123 and improve the financial health of the Department. 
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Question: When will DHS undergo an audit? Are there any timetables or benchmarks to 
achieve audit readiness? 

Answer: Pursuant to the DHS Financial Accountability Act (DHS FAA) and the Chief 
Financial Officer’s Act of 1990, the Department is subject to three types of audits: 

1 . A financial statement audit of the Department’s Consolidated Financial 
Statements. The Department has not yet received a department-wide audit 
opinion on its financial statements due to the existence of scope limitations and 
pervasive material weakness conditions; as a result, the scope of the audit has 
been limited to the balance sheet. 

2. An internal control audit of the Department’s internal controls over financial 
reporting. Consistent with the Secretary’s assurance statement and independent 
auditors’ report on internal controls, in Fiscal Year (FY) 2006 the Inspector 
General (IG) reported 10 material weaknesses and reported internal controls were 
not effective. 

3. Performance audits aimed at improving the Department’s corrective action and 
audit readiness efforts. These audits are not required by law; however, the DHS 
CFO and IG agree performance audits have proved invaluable in establishing an 
appropriate on-going level of auditor reporting that complements management’s 
corrective action efforts to implement Office of Management and Budget (0MB) 
Circular No. A-123. These audits further demonstrate management’s resolve and 
commitment to comply with the spirit of the DHS FAA. 

Although the Department received a disclaimer of a financial statement opinion at the 
consolidated level, substantial progress was achieved in FY 2006. Two components, 
U.S. Customs and Border Protection (CBP) and the Federal Law Enforcement Training 
Center (FLETC), received favorable audit outcomes. CBP obtained an unqualified 
opinion on all financial statements and FLETC achieved an unqualified opinion on its 
first ever balance sheet audit. Significant progress has also been achieved in reducing 
conditions that comprise the Department’s material weakness structure. For example, 
most significantly the U.S. Immigration and Customs Enforcement (ICE) eliminated five 
of its seven component-level material weakness conditions. 
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To resolve the internal control weaknesses and measure progress over the long term, the 
Department issued its first ever Department-wide corrective action plan in a document 
entitled the Internal Controls Over Financial Reporting (ICOFR) Playbook. The ICOFR 
Playbook outlines the additional steps the Department will take to resolve material 
weaknesses and build management assurances. The ICOFR Playbook includes focus 
areas to set priorities and sequencing of material weakness remediation efforts from FYs 
2007 through 2010. 
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Question: The Coast Guard is responsible for four of the ten material weaknesses cited in 
this past year’s department- wide independent auditors report. Can you provide a detailed 
timeline and strategy for improving financial management at the Coast Guard? 


Answer: 

Throughout the summer of 2006, the DHS CFO sponsored a series of Corrective Action 
Plan workshops designed to help the United States Coast Guard (USCG) and other DHS 
Components identify cross-cutting root causes of internal control deficiencies focusing on 
the areas of people, policies, processes, and systems. These workshops led to the 
establishment of the Department’s first ever Department-wide corrective action plan in a 
document entitled the Internal Controls Over Financial Reporting (ICOFR) Playbook. 

The ICOFR Playbook outlines the strategies and steps the Department will take to resolve 
material weaknesses and build management assurances. In addition, in March 2007, the 
USCG issued the Financial Strategy for Transformation and Audit Readiness (FSTAR). 
The FSTAR complements the ICOFR Playbook and provides a component-level strategy 
and milestones through Fiscal Year 2010 to transform its financial management 
organization, processes, procedures, internal controls, and systems. To help support and 
improve the performance of the USCG, corrective action plan efforts are formally 
monitored on a monthly basis by the Secretary, DHS CFO, and the Office of Inspector 
General. The Office of Management and Budget are also briefed monthly on the efforts. 
The ICOFR Playbook we provided to the committee includes the key milestones and 
timelines for the USCG’s improvement efforts. 


While this strategy will address the weaknesses identified by the auditors, building 
support for the Secretary’s assurance statement is the ultimate goal. 
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Question: The ICOFR playbook will be the comprehensive, department wide strategy to 
modernize financial management at the DHS. What benchmarks do you have in place to 
monitor progress? Do you have a measurable endgoal in mind? Will this new strategy 
resolve your 10 material weaknesses as identified by the independent auditor and will it 
bring you into compliance with the 8 laws and regulations you currently are not 
complying with? 


Answer: To ensure the quality of corrective actions and that audit findings are promptly 
resolved, corrective action progress will be monitored by the 0MB, DHS CFO, and DHS 
OIG. In addition, select Component CFOs are required to prepare monthly briefings for 
the 0MB, DHS CFO, and DHS OIG. These briefings substantiate claimed progress, 
report any delays, and provide justifications for missed milestones. In addition, the DHS 
OIG will periodically conduct performance audits on corrective action efforts to provide 
independent input and complement DHS Management corrective action efforts on a real- 
time basis. While audit outcomes are important, building support for the Secretary’s 
Assurance Statement is the measurable endgoal. 
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